PT-2017-1468 · Intel+1 · Intel Security Virusscan Enterprise Linux+1

Publicado 2017-03-14 · Atualizado 2017-09-03 · CVE-2016-8024

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Intel Security VirusScan Enterprise Linux (VSEL) versions 2.0.3 and earlier McAfee VirusScan Enterprise (affected versions not specified)

Description The issue is related to the improper neutralization of CRLF sequences in HTTP headers, which allows a remote unauthenticated attacker to obtain sensitive information via server HTTP response spoofing. This can be exploited by a remote attacker to gain access to confidential data.

Recommendations For Intel Security VirusScan Enterprise Linux (VSEL) versions 2.0.3 and earlier, update to a version later than 2.0.3 to resolve the issue. For McAfee VirusScan Enterprise, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-113

Identificadores relacionados

BDU:2017-00608

CVE-2016-8024

Produtos afetados

Intel Security Virusscan Enterprise Linux

Mcafee Virusscan Enterprise

Referências · 8

• 🔥 https://exploit-db.com/exploits/40911 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-8024 · Nota de Segurança
• http://securityfocus.com/bid/94823 · Nota
• https://bdu.fstec.ru/vul/2017-00608 · Nota de Segurança
• https://kc.mcafee.com/corporate/index?page=content&id=SB10181 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-8024 · Aviso do Fabricante
• http://securitytracker.com/id/1037433 · Nota
• https://kc.mcafee.com/corporate/index?page=content&id=SB10181 · Nota