full-disclosure - [INFIGO 2008-01-06]: McAfee E-Business Server Remote Preauth Code Execution / DoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <060301c852b1$48ba7f50$6a00a8c0@INFIGO03>
Date: Wed, 9 Jan 2008 12:17:55 +0100
From: "infocus" <infocus@...igo.hr>
To: <full-disclosure@...ts.grok.org.uk>
Subject: [INFIGO 2008-01-06]: McAfee E-Business Server
	Remote Preauth Code Execution / DoS

                 INFIGO IS Security Advisory #ADV-2008-01-06
                                  http://www.infigo.hr/en/

Title: McAfee E-Business Server Remote Preauth Code Execution / DoS
Advisory ID: INFIGO-2008-01-06
Date: 2008-01-09
Advisory URL: http://www.infigo.hr/en/in_focus/advisories/INFIGO-2008-01-06
Impact: Remote code execution
Risk Level: High
Vulnerability Type: Remote

==[ Overview

McAfee E-Business Server guards sensitive corporate data with
industry-standard
PGP 128-bit encryption and authentication. McAfee E-Business Server supports
a
variety of platforms and security certificates.

==[ Vulnerability

During an audit of McAfee E-Business Server, we have discovered a
vulnerability
in the administration interface (TCP port 1718).
It is possible to crash McAfee E-Business Server during the authentication
process.
When a malformed (oversized) initial authentication packet is sent to
E-Business Server,
the server will crash, and will have to be manually restarted.

A malformed authentication packet is shown below:
"\x01\x3f\x2f\x05\x25\x2a" + "A" * 69953

McAfee further researched the vulnerability and confirmed that it allows an
attacker
to also remotely execute code.

==[ Affected Version

The vulnerability has been identified in the latest available McAfee
E-Business Server 8.5.2, and it was successfully tested on Windows and Linux
platforms.
Previous versions are believed to be vulnerable as well.

==[ Fix

The vendor has addressed this vulnerability with E-Business server patch
update
on January 8th, 2008.

Vendor advisory and update link:
https://knowledge.mcafee.com/SupportSite/dynamickc.do?externalId=614472&sliceId=SAL_Public&command=show&forward=nonthreadedKC&kcId=614472

==[ PoC Exploit

http://www.infigo.hr/files/mcafee2.pl

==[ Vendor status

11.28.2007 - Initial contact
11.29.2007 - Initial vendor response
11.30.2007 - Vendor response
12.03.2007 - Vendor status update
12.10.2007 - Vendor status update
12.17.2007 - Vendor status update
01.07.2008 - Vendor status update
01.09.2008 - Coordinated public disclosure

==[ Credits

Vulnerability discovered by Leon Juranic <leon.juranic@...igo.hr>.

==[ INFIGO IS Security Contact

INFIGO IS,

WWW : http://www.infigo.hr/en/
E-mail : infocus@...igo.hr

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/