Vulnerabilites related to mcafee - cma
cve-2008-1357
Vulnerability from cvelistv5
Published
2008-03-17 17:00
Modified
2024-08-07 08:17
Severity ?
EPSS score ?
Summary
Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securityreason.com/securityalert/3748 | third-party-advisory, x_refsource_SREASON | |
| https://knowledge.mcafee.com/article/234/615103_f.sal_public.html | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/41178 | vdb-entry, x_refsource_XF | |
| http://www.securitytracker.com/id?1019609 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/29337 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/28228 | vdb-entry, x_refsource_BID | |
| http://aluigi.altervista.org/adv/meccaffi-adv.txt | x_refsource_MISC | |
| http://www.vupen.com/english/advisories/2008/0866/references | vdb-entry, x_refsource_VUPEN | |
| http://www.securityfocus.com/archive/1/489476/100/0/threaded | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:17:34.576Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "3748",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3748"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://knowledge.mcafee.com/article/234/615103_f.sal_public.html"
},
{
"name": "mcafee-framework-format-string(41178)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41178"
},
{
"name": "1019609",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019609"
},
{
"name": "29337",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29337"
},
{
"name": "28228",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/28228"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://aluigi.altervista.org/adv/meccaffi-adv.txt"
},
{
"name": "ADV-2008-0866",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0866/references"
},
{
"name": "20080312 Format string in McAfee Framework 3.6.0.569 (ePolicy Orchestrator 4.0)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/489476/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-03-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-11T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "3748",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3748"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://knowledge.mcafee.com/article/234/615103_f.sal_public.html"
},
{
"name": "mcafee-framework-format-string(41178)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41178"
},
{
"name": "1019609",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019609"
},
{
"name": "29337",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29337"
},
{
"name": "28228",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/28228"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://aluigi.altervista.org/adv/meccaffi-adv.txt"
},
{
"name": "ADV-2008-0866",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0866/references"
},
{
"name": "20080312 Format string in McAfee Framework 3.6.0.569 (ePolicy Orchestrator 4.0)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/489476/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-1357",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "3748",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3748"
},
{
"name": "https://knowledge.mcafee.com/article/234/615103_f.sal_public.html",
"refsource": "CONFIRM",
"url": "https://knowledge.mcafee.com/article/234/615103_f.sal_public.html"
},
{
"name": "mcafee-framework-format-string(41178)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41178"
},
{
"name": "1019609",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019609"
},
{
"name": "29337",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29337"
},
{
"name": "28228",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/28228"
},
{
"name": "http://aluigi.altervista.org/adv/meccaffi-adv.txt",
"refsource": "MISC",
"url": "http://aluigi.altervista.org/adv/meccaffi-adv.txt"
},
{
"name": "ADV-2008-0866",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0866/references"
},
{
"name": "20080312 Format string in McAfee Framework 3.6.0.569 (ePolicy Orchestrator 4.0)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/489476/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-1357",
"datePublished": "2008-03-17T17:00:00",
"dateReserved": "2008-03-17T00:00:00",
"dateUpdated": "2024-08-07T08:17:34.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-1855
Vulnerability from cvelistv5
Published
2008-04-16 19:00
Modified
2024-08-07 08:40
Severity ?
EPSS score ?
Summary
FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot (PrP), allows remote attackers to corrupt memory and cause a denial of service (CMA Framework service crash) via a long invalid method in requests for the /spin//AVClient//AVClient.csp URI, a different vulnerability than CVE-2006-5274.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/28573 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2008/1122/references | vdb-entry, x_refsource_VUPEN | |
| http://www.securitytracker.com/id?1019794 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/29637 | third-party-advisory, x_refsource_SECUNIA | |
| https://knowledge.mcafee.com/article/219/615324_f.SAL_Public.html | x_refsource_CONFIRM | |
| http://www.offensive-security.com/0day/mcafee_again.py.txt | x_refsource_MISC | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/41597 | vdb-entry, x_refsource_XF | |
| https://www.exploit-db.com/exploits/5343 | exploit, x_refsource_EXPLOIT-DB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:40:58.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "28573",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/28573"
},
{
"name": "ADV-2008-1122",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/1122/references"
},
{
"name": "1019794",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019794"
},
{
"name": "29637",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29637"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://knowledge.mcafee.com/article/219/615324_f.SAL_Public.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.offensive-security.com/0day/mcafee_again.py.txt"
},
{
"name": "mcafee-cma-frameworkservice-dos(41597)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41597"
},
{
"name": "5343",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/5343"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-04-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot (PrP), allows remote attackers to corrupt memory and cause a denial of service (CMA Framework service crash) via a long invalid method in requests for the /spin//AVClient//AVClient.csp URI, a different vulnerability than CVE-2006-5274."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "28573",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/28573"
},
{
"name": "ADV-2008-1122",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/1122/references"
},
{
"name": "1019794",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019794"
},
{
"name": "29637",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29637"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://knowledge.mcafee.com/article/219/615324_f.SAL_Public.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.offensive-security.com/0day/mcafee_again.py.txt"
},
{
"name": "mcafee-cma-frameworkservice-dos(41597)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41597"
},
{
"name": "5343",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/5343"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-1855",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot (PrP), allows remote attackers to corrupt memory and cause a denial of service (CMA Framework service crash) via a long invalid method in requests for the /spin//AVClient//AVClient.csp URI, a different vulnerability than CVE-2006-5274."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "28573",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/28573"
},
{
"name": "ADV-2008-1122",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/1122/references"
},
{
"name": "1019794",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019794"
},
{
"name": "29637",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29637"
},
{
"name": "https://knowledge.mcafee.com/article/219/615324_f.SAL_Public.html",
"refsource": "CONFIRM",
"url": "https://knowledge.mcafee.com/article/219/615324_f.SAL_Public.html"
},
{
"name": "http://www.offensive-security.com/0day/mcafee_again.py.txt",
"refsource": "MISC",
"url": "http://www.offensive-security.com/0day/mcafee_again.py.txt"
},
{
"name": "mcafee-cma-frameworkservice-dos(41597)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41597"
},
{
"name": "5343",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/5343"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-1855",
"datePublished": "2008-04-16T19:00:00",
"dateReserved": "2008-04-16T00:00:00",
"dateUpdated": "2024-08-07T08:40:58.272Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2008-04-16 19:05
Modified
2024-11-21 00:45
Severity ?
Summary
FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot (PrP), allows remote attackers to corrupt memory and cause a denial of service (CMA Framework service crash) via a long invalid method in requests for the /spin//AVClient//AVClient.csp URI, a different vulnerability than CVE-2006-5274.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mcafee:cma:*:*:*:*:*:*:*:*",
"matchCriteriaId": "51DEDB9E-714A-4ED0-8B3D-BD48F8A93586",
"versionEndIncluding": "3.6.0.574",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot (PrP), allows remote attackers to corrupt memory and cause a denial of service (CMA Framework service crash) via a long invalid method in requests for the /spin//AVClient//AVClient.csp URI, a different vulnerability than CVE-2006-5274."
},
{
"lang": "es",
"value": "FrameworkService.exe en McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 y anteriores, usado por ePolicy Orchestrator (ePO) y ProtectionPilot (PrP), permite a atacantes remotos corromper la memoria y provocar una denegaci\u00f3n de servico (ca\u00edda del servicio CMA Framework) a trav\u00e9s de un m\u00e9todo largo inv\u00e1lido en una petici\u00f3n al URI /spin//AVClient//AVClient.csp. Vulnerabilidad distinta del CVE-2006-5274."
}
],
"id": "CVE-2008-1855",
"lastModified": "2024-11-21T00:45:30.680",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-04-16T19:05:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29637"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.offensive-security.com/0day/mcafee_again.py.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/28573"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019794"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/1122/references"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41597"
},
{
"source": "cve@mitre.org",
"url": "https://knowledge.mcafee.com/article/219/615324_f.SAL_Public.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/5343"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29637"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.offensive-security.com/0day/mcafee_again.py.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/28573"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019794"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/1122/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41597"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://knowledge.mcafee.com/article/219/615324_f.SAL_Public.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/5343"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-03-17 17:44
Modified
2024-11-21 00:44
Severity ?
Summary
Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mcafee:agent:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43953695-9C35-4CC3-9591-D03866731F47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mcafee:cma:3.0.6.453:*:*:*:*:*:*:*",
"matchCriteriaId": "9B7D230B-845A-4E83-B86C-000CDBAC937F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mcafee:cma:3.5.5.438:*:*:*:*:*:*:*",
"matchCriteriaId": "4A0590CC-B03B-472B-A5FF-F6A316DBE2DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mcafee:cma:3.6.438:*:*:*:*:*:*:*",
"matchCriteriaId": "0BD368FB-2683-4321-9491-CB757511AD49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mcafee:cma:3.6.453:*:*:*:*:*:*:*",
"matchCriteriaId": "F64F9F3F-F835-4769-9A5B-A05ED2AE7850",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mcafee:cma:3.6.546:*:*:*:*:*:*:*",
"matchCriteriaId": "3C0AE0A0-E56A-4B93-B45B-037C09EA69C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mcafee:cma:3.6.574:*:*:*:*:*:*:*",
"matchCriteriaId": "CFF00F5B-4272-49CC-A9CE-4CCD20F5DB3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "485DB16F-730A-44B2-A255-2583AB27DB9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mcafee:mcafee_framework:3.6.569:*:*:*:*:*:*:*",
"matchCriteriaId": "6330056D-1DAF-4821-90E5-1E9E52594A25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8."
},
{
"lang": "es",
"value": "Vulnerabilidad en el formato de cadena en la funci\u00f3n logDetail de applib.dlld en McAfee Common Management Agent (CMA) 3.6.0.574 (Parche 3) y anteriores, como se utiliza en ePolicy Orchestrator 4.0.0 build 1015, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda) o ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de formatos de especificadores de formatos de cadena en un fichero de env\u00edo en una solicitud AgentWakeup en el puerto 8082. NOTA: esta vulnerabilidad s\u00f3lo sucede cuando se est\u00e1 en un nivel 8 de depuraci\u00f3n."
}
],
"id": "CVE-2008-1357",
"lastModified": "2024-11-21T00:44:21.487",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-03-17T17:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://aluigi.altervista.org/adv/meccaffi-adv.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29337"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/3748"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/489476/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/28228"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019609"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0866/references"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41178"
},
{
"source": "cve@mitre.org",
"url": "https://knowledge.mcafee.com/article/234/615103_f.sal_public.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://aluigi.altervista.org/adv/meccaffi-adv.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29337"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/3748"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/489476/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/28228"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019609"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0866/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41178"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://knowledge.mcafee.com/article/234/615103_f.sal_public.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-134"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}