PT-2012-5503 · Mcafee · Mcafee Email/Web Security+1

Published 2012-08-22 · Updated 2017-08-29 · CVE-2012-4595

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security (EWS) versions 5.5 through Patch 6 McAfee Email and Web Security (EWS) versions 5.6 through Patch 3 McAfee Email Gateway (MEG) version 7.0.0 McAfee Email Gateway (MEG) version 7.0.1

Description The issue allows remote attackers to bypass authentication and obtain an admin session ID.

Recommendations For McAfee Email and Web Security (EWS) versions 5.5 through Patch 6, apply a patch to a version later than Patch 6. For McAfee Email and Web Security (EWS) versions 5.6 through Patch 3, apply a patch to a version later than Patch 3. For McAfee Email Gateway (MEG) version 7.0.0, update to a version later than 7.0.0. For McAfee Email Gateway (MEG) version 7.0.1, update to a version later than 7.0.1.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-4595

Affected Products

Mcafee Email Gateway

Mcafee Email/Web Security

References · 4

• https://kc.mcafee.com/corporate/index?page=content&id=SB10026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4595 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77977 · Note
• http://securitytracker.com/id?1027444 · Note