QID 375713

Date Published: 2023-08-10

QID 375713: McAfee ePolicy Orchestrator Information Disclosure Vulnerability In Agent Handler (SB10286)

McAfee ePolicy Orchestrator (ePO) software centralizes and streamlines management of endpoint, network, content security and compliance solutions.

ePO offers the ability to configure the communication between the McAfee Agent Handler and
the SQL Server to be plain text or encrypted over TLS. The Agent Handler was only honoring some
of the TLS options, and was incorrectly reverting to plain text communication for the others.
CVE-2019-3619

Affected Products:
ePO 5.10.0 Prior to 5.10.0 Update 4
ePO From 5.9.0 Prior to 5.9.1 Hotfix 1267793 (HF1267793)

QID Detection Logic:
This checks for vulnerable versions of ePoSign and check build number for hotfix and version of jre for update.

Successful exploitation allows a remote unauthenticated attacker to view sensitive information in plain text via sniffing the traffic between the Agent Handler and the SQL Server.

CVSS V3 rated as Medium - 4.9 severity.

CVSS V2 rated as Medium - 4 severity.

Solution

Vendor has advised to install one of the following ePolicy Orchestrator (ePO) versions: 5.10.0 Update 4 or EPO591HF1267793 Hotfix

Customers are advised to review SB10286 for more information.

Workaround:
McAfee strongly recommends that you install the available update/hotfix. If you cannot, consider forcing encryption while connecting to the database as a temporary workaround.

Vendor References

SB10286 - kc.mcafee.com/corporate/index?page=content&id=SB10286

CVEs related to QID 375713

CVE-2019-3619 |

Software Advisories

Advisory ID	Software	Component	Link
apsb21-40			helpx.adobe.com/security/products/dimension/apsb21-40.html

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].