CERTA-2007-AVI-297

Vulnerability from certfr_avis - Published: - Updated:

Plusieurs vulnérabilités affectent le module Common Management Agent des produits McAfee ePolicy Orchestrator et Protection Pilot et peuvent etre utilisées par un utilisateur malveillant pour exécuter du code arbitraire à distance.

Description

Plusieurs vulnérabilités du type dépassement de pile et corruption mémoire affectent le module Common Management Agent des produits McAfee ePolicy Orchestrator et Protection Pilot. Elles peuvent être utilisées par un utilisateur malveillant pour exécuter du code arbitraire à distance et provoquer des dénis de service.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Les versions antérieures à McAfee Common Management Agent 3.6.0 Patch 1 (CMA3.6.0.546).

Impacted products
Vendor Product Description
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eLes versions ant\u00e9rieures \u00e0 McAfee  Common Management Agent 3.6.0 Patch 1 (CMA3.6.0.546).\u003c/p\u003e",
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s du type d\u00e9passement de pile et corruption\nm\u00e9moire affectent le module Common Management Agent des produits McAfee\nePolicy Orchestrator et Protection Pilot. Elles peuvent \u00eatre utilis\u00e9es\npar un utilisateur malveillant pour ex\u00e9cuter du code arbitraire \u00e0\ndistance et provoquer des d\u00e9nis de service.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-5272",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5272"
    },
    {
      "name": "CVE-2006-5274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5274"
    },
    {
      "name": "CVE-2006-5271",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5271"
    },
    {
      "name": "CVE-2006-5273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5273"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 McAfee 613367 :",
      "url": "https://knowledge.mcafee.com/article/764/613367_f.SAL_Public.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 McAfee 613365 :",
      "url": "https://knowledge.mcafee.com/article/762/613365_f.SAL_Public.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 McAfee 613364 :",
      "url": "https://knowledge.mcafee.com/article/761/613364_f.SAL_Public.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 McAfee 613366 :",
      "url": "https://knowledge.mcafee.com/article/763/613366_f.SAL_Public.html"
    }
  ],
  "reference": "CERTA-2007-AVI-297",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-07-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s affectent le module Common Management Agent des\nproduits McAfee \u003cspan class=\"textit\"\u003eePolicy Orchestrator\u003c/span\u003e et\n\u003cspan class=\"textit\"\u003eProtection Pilot\u003c/span\u003e et peuvent etre utilis\u00e9es\npar un utilisateur malveillant pour ex\u00e9cuter du code arbitraire \u00e0\ndistance.\n",
  "title": "Multiples vuln\u00e9rabili\u00e9s du Common Management Agent (CMA) de McAfee",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 de Secunia SA26029 du 11 juillet 2007",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 McAfee de 613364 \u00e0 613367",
      "url": null
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.