PT-2015-5942 · Intel Mcafee · Intel Mcafee Epolicy Orchestrator

Published 2015-06-23 · Updated 2016-12-03 · CVE-2015-2859

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Intel McAfee ePolicy Orchestrator (ePO) versions 4.x through 4.6.9 Intel McAfee ePolicy Orchestrator (ePO) versions 5.x through 5.1.2

Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted X.509 certificate, as it does not validate server names and Certification Authority names in X.509 certificates from SSL servers.

Recommendations For versions 4.x through 4.6.9, update to a version that includes the fix for this issue. For versions 5.x through 5.1.2, update to a version that includes the fix for this issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2015-2859

Affected Products

Intel Mcafee Epolicy Orchestrator

References · 7

• https://kc.mcafee.com/corporate/index?page=content&id=KB84628 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2859 · Security Note
• http://securityfocus.com/bid/75020 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2859 · Note
• http://kb.cert.org/vuls/id/264092 · Note
• http://securitytracker.com/id/1032571 · Note