Advisory Details

April 11th, 2011

McAfee Firewall Reporter GeneralUtilities.pm isValidClient Authentication Bypass Vulnerability

ZDI-11-117
ZDI-CAN-938

CVE ID
CVSS SCORE 10, (AV:N/AC:L/Au:N/C:C/I:C/A:C)
AFFECTED VENDORS McAfee
AFFECTED PRODUCTS Firewall Reporter
TREND MICRO CUSTOMER PROTECTION Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 10522. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of McAfee Firewall Reporter. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the code responsible for authenticating users. The GernalUtilities.pm file contains code to validate sessions by parsing cookie values without sanitization. The faulty logic simply checks for the existence of a particular file, without verifying its contents. By using a directory traversal technique an attacker can point the cgisess cookie value to an arbitrary file that exists on the server and thus bypass authentication.

ADDITIONAL DETAILS

Fixed February 9, 2011
Bulletin modified April 11, 2011:
https://kc.mcafee.com/corporate/index?page=content&id=SB10015


DISCLOSURE TIMELINE
  • 2010-09-22 - Vulnerability reported to vendor
  • 2011-04-11 - Coordinated public release of advisory
CREDIT Andrea Micalizzi aka rgod
BACK TO ADVISORIES