bugtraq - Re: ZDI-11-117: McAfee Firewall Reporter GeneralUtilities.pm isValidClient Authentication Bypass Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201104132015.p3DKF1bo026077@www5.securityfocus.com>
Date: Wed, 13 Apr 2011 14:15:01 -0600
From: nospam@...il.it
To: bugtraq@...urityfocus.com
Subject: Re: ZDI-11-117: McAfee Firewall Reporter GeneralUtilities.pm
 isValidClient Authentication Bypass Vulnerability

McAfee stated:

[quote]
 Impact of Vulnerability:
Disabling Anti-Virus, adding unwanted exclusions
[/quote]

When submitting this bug to ZDI, I made availiable two reliable post-bypass proof-of-concepts: 
- a static perl code injection exploit using the 'args' argument of saveTopImagelogos.cgi
- an upload and execute exploit using uploadFile.cgi

In both cases, the result was remote command execution with SYSTEM privileges. This was tested against the default Apache installation.
ZDI did not acquire post-auth vulnerabilities, so I was considering to disclose them after the patch was out but, in the end, not.

I'm saying this to allow people to classify this vulnerability with the correct metrics.

rgod