FireEye Operating System Multiple Vulnerabilities

medium Nessus Plugin ID 89724

Language:

Synopsis

The remote host is missing a vendor-supplied security patch.

Description

The remote host is running a version of FireEye Operating System (FEOS) that is missing a vendor-supplied security patch. It is, therefore, affected by multiple vulnerabilities :

- A flaw exists in the Virtual Execution Engine (VXE) during the handling of file names that were previously flagged for the whitelist. A remote attacker can exploit this, via subsequent malicious files with the same file name, to bypass the analysis engine.

- A flaw exists when handling a specially crafted URL that allows an authenticated, remote attacker to render plaintext in the web user interface post-authentication, resulting in the disclosure of sensitive information.

NOTE: FX version 7.5.0 is affected by the Analysis Engine Evasion vulnerability, but NOT the URL Encoded Bypass vulnerability.

Solution

Apply the relevant patch referenced in the vendor advisory.

Plugin Details

Severity: Medium

ID: 89724

File Name: fireeye_os_2015Q4_url_injection.nasl

Version: 1.7

Type: local

Family: Firewalls

Published: 3/7/2016

Updated: 1/2/2019

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N

Vulnerability Information

CPE: cpe:/o:fireeye:feos

Required KB Items: Host/FireEye/series, Host/FireEye/version

Patch Publication Date: 12/31/2015

Vulnerability Publication Date: 12/31/2015

Detections

Analytics