McAfee Email Gateway Multiple Vulnerabilities (SB10064)

high Nessus Plugin ID 73225

Synopsis

The remote host is affected by multiple SQL injection and command execution vulnerabilities.

Description

The remote host is running a version of McAfee Email Gateway (MEG) that is affected by multiple SQL injection and command execution vulnerabilities:

- Multiple SQL injections vulnerabilities exist in the administrative web interface. A remote, authenticated attacker could potentially exploit these vulnerabilities to run arbitrary SQL commands. (CVE-2013-7092)

- A command execution vulnerability exists in the administrative web interface due to a failure to sanitize user input to the 'TestFile' XML element. A remote, authenticated attacker could potentially exploit this vulnerability to run arbitrary shell commands.
(CVE-2013-7103)

- A command execution vulnerability exists in the administrative web interface due to a failure to sanitize user input to the 'Command' and 'Script' XML attribute. A remote, authenticated attacker could potentially exploit this vulnerability to run arbitrary shell commands. (CVE-2013-7104)

Solution

Apply the relevant hotfix referenced in the vendor advisory.

See Also

https://kc.mcafee.com/corporate/index?page=content&id=SB10064

https://seclists.org/fulldisclosure/2013/Dec/18

Plugin Details

Severity: High

ID: 73225

File Name: mcafee_email_gateway_SB10064.nasl

Version: 1.8

Type: local

Family: CGI abuses

Published: 3/27/2014

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:mcafee:email_gateway

Required KB Items: Host/McAfeeSMG/name, Host/McAfeeSMG/version, Host/McAfeeSMG/patches

Exploit Ease: No known exploits are available

Patch Publication Date: 2/19/2014

Vulnerability Publication Date: 12/3/2013

Reference Information

CVE: CVE-2013-7092, CVE-2013-7103, CVE-2013-7104

BID: 64150

MCAFEE-SB: SB10064