PT-2006-5894 · Mcafee · Mcafee Epolicy Orchestrator+1

Muts · Published 2006-10-03 · Updated 2017-07-20 · CVE-2006-5156

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator versions prior to 5.0.0 is not specified, however, it is mentioned that versions before 3.5.0.720 are affected. McAfee ProtectionPilot versions prior to 1.1.1.126

Description A buffer overflow issue allows remote attackers to execute arbitrary code via a request to "/spipe/pkg/" with a long source header.

Recommendations For McAfee ePolicy Orchestrator versions before 3.5.0.720, update to version 3.5.0.720 or later. For McAfee ProtectionPilot versions before 1.1.1.126, update to version 1.1.1.126 or later. As a temporary workaround, consider restricting access to the "/spipe/pkg/" endpoint until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2006-5156

Affected Products

Mcafee Protectionpilot

Mcafee Epolicy Orchestrator

References · 19

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/mcafee_epolicy_source.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16783 · Exploit
• 🔥 http://remote-exploit.org/advisories/mcafee-epo.pdf · Exploit
• 🔥 http://securityfocus.com/bid/20288 · Exploit
• 🔥 https://exploit-db.com/exploits/2467 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5156 · Security Note
• http://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC&docType=kc&externalId=8611438&sliceId=SAL_Public&dialogID=2997768&stateId=0%200%202995803 · Patch
• http://download.nai.com/products/patches/protectionpilot/v1.1.1/PRP1113.txt · Patch
• http://download.nai.com/products/patches/ePO/v3.5/EPO3506.txt · Patch
• http://secunia.com/advisories/22222 · Vendor Advisory
• http://osvdb.org/29421 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29307 · Note
• http://securitytracker.com/id?1016970 · Note
• http://knowledge.mcafee.com/article/365/8611438_f.SAL_Public.html · Note
• http://vupen.com/english/advisories/2006/3861 · Note