admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-06-21 05:40:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1746 from lordoxley/patch-15

Browse Source 
Update CVE-2018-6703
This commit is contained in:
CVE Team 2019-03-25 15:04:55 -04:00 committed by GitHub
commit f2941f21d0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 91 additions and 110 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
2018/6xxx/CVE-2018-6703.json
View File

@ -3,7 +3,7 @@
"ASSIGNER": "psirt@mcafee.com", "ASSIGNER": "psirt@mcafee.com",
"ID": "CVE-2018-6703", "ID": "CVE-2018-6703",
"STATE": "PUBLIC", "STATE": "PUBLIC",
"TITLE": "McAfee Agent Incorrect memory and handle management vulnerability" "TITLE": "Remote Logging functionality had a use after free vulnerability in McAfee Agent"
}, },
"affects": { "affects": {
"vendor": { "vendor": {
@ -12,45 +12,24 @@
"product": { "product": {
"product_data": [ "product_data": [
{ {
"product_name": "McAfee Agent (MA)", "product_name": "McAfee Agent",
"version": { "version": {
"version_data": [ "version_data": [
{ {
"affected": ">=", "version_affected": "<",
"platform": "x86", "version_name": "5.x",
"version_name": "5.0.0", "version_value": "5.6.0"
"version_value": "5.0.0"
},
{
"affected": "<=",
"platform": "x86",
"version_name": "5.0.6",
"version_value": "5.0.6"
},
{
"version_name": "5.5.0",
"version_value": "5.5.0"
},
{
"version_name": "5.5.1",
"version_value": "5.5.1"
} }
] ]
} }
} }
] ]
}, },
"vendor_name": "McAfee" "vendor_name": "McAfee, LLC"
} }
] ]
} }
}, },
"credit": [
{
"lang": "eng",
"value": "McAfee credits Frank Cozijnsen of the KPN RED-team for reporting this flaw."
}
],
"data_format": "MITRE", "data_format": "MITRE",
"data_type": "CVE", "data_type": "CVE",
"data_version": "4.0", "data_version": "4.0",
@ -58,23 +37,26 @@
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "Use After Free in McAfee Common service in McAfee Agent (MA) 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted TCP packet." "value": "Use After Free in Remote logging (which is disabled by default) in McAfee McAfee Agent (MA) 5.x prior to 5.6.0 allows remote unauthenticated attackers to cause a Denial of Service and potentially a remote code execution via a specially crafted HTTP header sent to the logging service."
} }
] ]
}, },
"generator": {
"engine": "Vulnogram 0.0.5"
},
"impact": { "impact": {
"cvss": { "cvss": {
"attackComplexity": "LOW", "attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK", "attackVector": "NETWORK",
"availabilityImpact": "LOW", "availabilityImpact": "HIGH",
"baseScore": 4.3, "baseScore": 9.8,
"baseSeverity": "MEDIUM", "baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE", "confidentialityImpact": "HIGH",
"integrityImpact": "NONE", "integrityImpact": "HIGH",
"privilegesRequired": "NONE", "privilegesRequired": "NONE",
"scope": "UNCHANGED", "scope": "UNCHANGED",
"userInteraction": "NONE", "userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0" "version": "3.0"
} }
}, },
@ -84,7 +66,7 @@
"description": [ "description": [
{ {
"lang": "eng", "lang": "eng",
"value": "Use After Free (CWE-416)" "value": "Use After Free"
} }
] ]
} }
@ -100,13 +82,12 @@
] ]
}, },
"source": { "source": {
"advisory": "SB10258", "discovery": "UNKNOWN"
"discovery": "EXTERNAL"
}, },
"work_around": [ "work_around": [
{ {
"lang": "eng", "lang": "eng",
"value": "McAfee highly recommends that all customers upgrade to McAfee Agent 5.6.0.\n\nIf you cannot upgrade, consider the below configuration change as a temporary workaround.\nDisable the remote logging feature via policy:\nGo to the assigned policy type General for the product McAfee Agent.\nGo to Logging tab.\nDisable Enable remote access to log." "value": "Remote logging is disabled by default. Turning off remote logging protects against this issue."
} }
] ]
} }