PT-2014-4768 · Mcafee+1 · Mcafee Cloud Single Sign On+2

Publicado 2014-03-18 · Atualizado 2014-04-01 · CVE-2014-2536

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions McAfee Cloud Identity Manager versions 3.0 through 3.5.1 McAfee Cloud Single Sign On (MCSSO) versions prior to 4.0.1 Intel Expressway Cloud Access 360-SSO versions 2.1 through 2.5

Description A directory traversal issue allows remote authenticated users to read a file containing a hash of the administrator password.

Recommendations For McAfee Cloud Identity Manager versions 3.0 through 3.5.1, update to a version outside of the affected range. For McAfee Cloud Single Sign On (MCSSO) versions prior to 4.0.1, update to version 4.0.1 or later. For Intel Expressway Cloud Access 360-SSO versions 2.1 through 2.5, consider restricting access to sensitive files until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-2536

Produtos afetados

Intel Expressway Cloud Access 360-Sso

Mcafee Cloud Identity Manager

Mcafee Cloud Single Sign On

Referências · 5

• https://kc.mcafee.com/corporate/index?page=content&id=SB10066 · Aviso do Fabricante
• http://secunia.com/advisories/57381 · Aviso do Fabricante
• http://secunia.com/advisories/57368 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-2536 · Nota de Segurança
• http://securityfocus.com/bid/66181 · Nota