McAfee Common Management Agent 3.6.0 UDP Packet Handling Format String

This script is Copyright (C) 2008-2014 Tenable Network Security, Inc.

Synopsis :

A remote service may be affected by a format string vulnerability.

Description :

The remote host is running a Common Management Agent, a component of
the ePolicy Orchestrator system security management solution from

The version of the Common Management Agent on the remote host is
earlier than and, as such, contains a format string
vulnerability. If configured with a debug level of 8 (its highest
level but not the default), an unauthenticated, remote attacker may be
able to leverage this issue by sending a specially crafted UDP packet
to the agent broadcast port to crash the service or even execute
arbitrary code on the affected host.

Note that Nessus has not looked at the setting of the LogLevel, only
the version number in the agent's banner, so it may not actually be
vulnerable to attack.

See also :

Solution :

Apply Hotfix BZ398370 Build 595 for Common Management Agent 3.6.0
Patch 3.

Risk factor :

Medium / CVSS Base Score : 5.1
CVSS Temporal Score : 4.4
Public Exploit Available : true

Family: Web Servers

Nessus Plugin ID: 31732 ()

Bugtraq ID: 28228

CVE ID: CVE-2008-1357

Ready to Scan Unlimited IPs & Run Compliance Checks?

Upgrade to Nessus Professional today!

Buy Now

Combine the Power of Nessus with the Ease of Cloud

Start your free Nessus Cloud trial now!

Begin Free Trial