McAfee Email Gateway 'systemWebAdminConfig.do' Remote Security Bypass Vulnerability

Bugtraq ID:	40255
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 19 2010 12:00AM
Updated:	May 19 2010 12:00AM
Credit:	Nahuel Grisolia from Cybsec Labs
Vulnerable:	McAfee Email Gateway 6.7.1 McAfee Email Gateway 0
Not Vulnerable:

McAfee Email Gateway 'systemWebAdminConfig.do' Remote Security Bypass Vulnerability

McAfee Email Gateway is prone to a security-bypass vulnerability because the web-based interface fails to properly perform user-profile checks.

Attackers can exploit this issue to bypass certain security restrictions to edit property and configuration settings.

McAfee Email Gateway 6.7.1 is vulnerable; other versions may also be affected.

McAfee Email Gateway 'systemWebAdminConfig.do' Remote Security Bypass Vulnerability

Attackers can exploit this issue with a web browser.

The following example request is available:

• /data/vulnerabilities/exploits/40255.txt

McAfee Email Gateway 'systemWebAdminConfig.do' Remote Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

McAfee Email Gateway 'systemWebAdminConfig.do' Remote Security Bypass Vulnerability

References:

• Web Administration Broken Access Control in McAfee Email Gateway (form (CYBSEC)
  
• McAfee Homepage (McAfee)