McAfee Common Management Agent 3.6.0 UDP Packet Handling Format String

This script is Copyright (C) 2008-2014 Tenable Network Security, Inc.


Synopsis :

A remote service may be affected by a format string vulnerability.

Description :

The remote host is running a Common Management Agent, a component of
the ePolicy Orchestrator system security management solution from
McAfee.

The version of the Common Management Agent on the remote host is
earlier than 3.6.0.595 and, as such, contains a format string
vulnerability. If configured with a debug level of 8 (its highest
level but not the default), an unauthenticated, remote attacker may be
able to leverage this issue by sending a specially crafted UDP packet
to the agent broadcast port to crash the service or even execute
arbitrary code on the affected host.

Note that Nessus has not looked at the setting of the LogLevel, only
the version number in the agent's banner, so it may not actually be
vulnerable to attack.

See also :

http://aluigi.altervista.org/adv/meccaffi-adv.txt
http://www.securityfocus.com/archive/1/archive/1/489476/100/0/threaded

Solution :

Apply Hotfix BZ398370 Build 595 for Common Management Agent 3.6.0
Patch 3.

Risk factor :

Medium / CVSS Base Score : 5.1
(CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 4.4
(CVSS2#E:POC/RL:W/RC:C)
Public Exploit Available : true

Family: Web Servers

Nessus Plugin ID: 31732 ()

Bugtraq ID: 28228

CVE ID: CVE-2008-1357