McAfee E-Business Server Authentication Remote Code Execution Vulnerability
BID:27197
Info
McAfee E-Business Server Authentication Remote Code Execution Vulnerability
| Bugtraq ID: | 27197 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-0127 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 09 2008 12:00AM |
| Updated: | May 07 2015 05:33PM |
| Credit: | Leon Juranic <[email protected]> discovered this issue. |
| Vulnerable: |
McAfee E-Business Server 8.5.2 McAfee E-Business Server 8.5.1 McAfee E-Business Server 8.1.2 McAfee E-Business Server 8.1.1 McAfee E-Business Server 8.1 McAfee E-Business Server 7.1.1 |
| Not Vulnerable: |
McAfee E-Business Server 8.5.3 |
Discussion
McAfee E-Business Server Authentication Remote Code Execution Vulnerability
McAfee E-Business Server is prone to a remote code-execution vulnerability that occurs prior to authentication.
Attackers can leverage this issue to execute arbitrary code with superuser privileges. Successful exploits will completely compromise affected computers. Failed attacks will cause denial-of-service conditions.
E-Business Server 8.5.2 and prior versions are vulnerable.
NOTE: This issue may be related to the issue described in BID 26269 (McAfee E-Business Server Authentication Packet Handling Integer Overflow Vulnerability).
McAfee E-Business Server is prone to a remote code-execution vulnerability that occurs prior to authentication.
Attackers can leverage this issue to execute arbitrary code with superuser privileges. Successful exploits will completely compromise affected computers. Failed attacks will cause denial-of-service conditions.
E-Business Server 8.5.2 and prior versions are vulnerable.
NOTE: This issue may be related to the issue described in BID 26269 (McAfee E-Business Server Authentication Packet Handling Integer Overflow Vulnerability).
Exploit / POC
McAfee E-Business Server Authentication Remote Code Execution Vulnerability
The following proof-of-concept code is available:
The following proof-of-concept code is available:
Solution / Fix
McAfee E-Business Server Authentication Remote Code Execution Vulnerability
Solution:
The vendor released an advisory and fixes to address this issue. Please see the references for more information.
Solution:
The vendor released an advisory and fixes to address this issue. Please see the references for more information.
References
McAfee E-Business Server Authentication Remote Code Execution Vulnerability
References:
References: