OSVDB ID: 5626 Title: McAfee ePolicy Orchestrator HTTP POST spipe/file Handler Arbitrary File Creation |
Info |
|
|
Dates |
||||
|
|
Description |
McAfee ePolicy Orchestrator contains a flaw that may allow a malicious user to execute arbitrary code with system privileges. The flaw is due to the server not properly sanitizing HTTP POST requests. If an attacker supplies a specially crafted request, they may be able to create arbitrary files. With the right files, it is possible to create an installation package that would be executed under some circumstances, allowing arbitrary commands and files to be run with the privileges of the ePo server. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Disclosure: OSVDB Verified OSVDB: Web Related, Security Software |
Solution |
Upgrade to version 2.5.1 Patch 14 or higher or 3.0 SP2a Patch 4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|