McAfee Email Gateway Unspecified Command Injection Vulnerability

Bugtraq ID:	63544
Class:	Input Validation Error
CVE:	CVE-2013-6349
Remote:	Yes
Local:	No
Published:	Oct 15 2013 12:00AM
Updated:	Oct 15 2013 12:00AM
Credit:	ANZ Bank
Vulnerable:	McAfee Email Gateway 7.0 Patch 1 McAfee Email Gateway 7.0
Not Vulnerable:	McAfee Email Gateway 6.7.2 Hotfix 2 McAfee Email Gateway 6.7.2 Hotfix 1

McAfee Email Gateway Unspecified Command Injection Vulnerability

McAfee Email Gateway is prone to an unspecified command-injection vulnerability because it fails to adequately sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary commands with root privileges. Successful exploits could compromise the application and possibly the underlying system.

The following versions are affected:

McAfee Email Gateway 7.0 through 7.0.3
McAfee Email Gateway 7.5 through 7.5.0

McAfee Email Gateway Unspecified Command Injection Vulnerability

The researcher who discovered this issue has created a proof-of-concept to demonstrate the issue. The exploit is otherwise not publicly available.

McAfee Email Gateway Unspecified Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

McAfee Email Gateway Unspecified Command Injection Vulnerability

References:

• McAfee Homepage (McAfee)