Multiple McAfee Products CVE-2014-8565 Password Hash Algorithm Security Weakness

Bugtraq ID:	70865
Class:	Design Error
CVE:	CVE-2014-8565
Remote:	Yes
Local:	No
Published:	Oct 31 2014 12:00AM
Updated:	Oct 31 2014 12:00AM
Credit:	Matthias Deeg
Vulnerable:	McAfee File and Removable Media Protection 4.3.0.0 McAfee Endpoint Encryption for Files and Folders 4.2 McAfee Endpoint Encryption for Files and Folders 4.1 McAfee Endpoint Encryption for Files and Folders 4.0 McAfee Endpoint Encryption for Files and Folders 3.2
Not Vulnerable:

Multiple McAfee Products CVE-2014-8565 Password Hash Algorithm Security Weakness

Multiple McAfee Products is prone to a security weakness due to insecure password-hash algorithm.

Attackers can exploit this issue to perform brute-force attacks and obtain user passwords which may aid in further attacks.

The following products are vulnerable:

McAfee Endpoint Encryption for Files and Folders 3.2.x, 4.0.x, 4.1.x and 4.2.x.
McAfee File and Removable Media Protection 4.3.0.x

Multiple McAfee Products CVE-2014-8565 Password Hash Algorithm Security Weakness

An attacker can exploit this issue using readily available tools.

Multiple McAfee Products CVE-2014-8565 Password Hash Algorithm Security Weakness

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple McAfee Products CVE-2014-8565 Password Hash Algorithm Security Weakness

References: