PT-2015-5942 · Intel Mcafee · Intel Mcafee Epolicy Orchestrator

Publicado 2015-06-23 · Atualizado 2016-12-03 · CVE-2015-2859

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Intel McAfee ePolicy Orchestrator (ePO) versions 4.x through 4.6.9 Intel McAfee ePolicy Orchestrator (ePO) versions 5.x through 5.1.2

Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted X.509 certificate, as it does not validate server names and Certification Authority names in X.509 certificates from SSL servers.

Recommendations For versions 4.x through 4.6.9, update to a version that includes the fix for this issue. For versions 5.x through 5.1.2, update to a version that includes the fix for this issue.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2015-2859

Produtos afetados

Intel Mcafee Epolicy Orchestrator

Referências · 7

• https://kc.mcafee.com/corporate/index?page=content&id=KB84628 · Aviso do Fabricante
• https://kc.mcafee.com/corporate/index?page=content&id=SB10120 · Aviso do Fabricante
• http://securityfocus.com/bid/75020 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2859 · Nota
• http://kb.cert.org/vuls/id/264092 · Nota
• http://securitytracker.com/id/1032571 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2859 · Nota de Segurança