McAfee ePolicy Orchestrator Java Object Deserialization RCE

critical Nessus Plugin ID 88624

Language:

Synopsis

A security management application installed on the remote Windows host is affected by a remote code execution vulnerability.

Description

The McAfee ePolicy Orchestrator (ePO) installed on the remote Windows host is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections (ACC) library. An unauthenticated, remote attacker can exploit this to execute arbitrary code on the target host.

Solution

Upgrade to McAfee ePO version 5.1.3 / 5.3.1 and then apply hotfix EPO5xHF1106041.zip. A patch for ePO version 5.1.4 is scheduled to be released in Q2 of 2016.

Plugin Details

Severity: Critical

ID: 88624

File Name: mcafee_epo_sb10144.nasl

Version: 1.8

Type: local

Agent: windows

Family: Windows

Published: 2/8/2016

Updated: 11/15/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.0

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:mcafee:epolicy_orchestrator

Required KB Items: SMB/Registry/Enumerated, installed_sw/McAfee ePO

Exploit Ease: No known exploits are available

Patch Publication Date: 12/30/2015

Vulnerability Publication Date: 1/28/2015

Reference Information

CVE: CVE-2015-8765

BID: 85696

CERT: 576313

MCAFEE-SB: SB10144

Detections

Analytics