McAfee Web Gateway Directory Traversal Vulnerability

Bugtraq ID:	66193
Class:	Design Error
CVE:	CVE-2014-2535
Remote:	Yes
Local:	No
Published:	Feb 24 2014 12:00AM
Updated:	Mar 25 2014 12:58AM
Credit:	Ilyas Orak from Biznet Bilisim
Vulnerable:
Not Vulnerable:

McAfee Web Gateway Directory Traversal Vulnerability

McAfee Web Gateway is prone to a directory-traversal vulnerability.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

The following versions are vulnerable:

McAfee Web Gateway 7.4.0 and prior
McAfee Web Gateway 7.3.2.4 and prior
McAfee Web Gateway 7.2.0.9 and prior

McAfee Web Gateway Directory Traversal Vulnerability

Attackers can exploit this issue with a web browser or readily available tools.

McAfee Web Gateway Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

McAfee Web Gateway Directory Traversal Vulnerability

References:

• McAfee Homepage (McAfee)
  
• McAfee Web Gateway Homepage (McAfee)