Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT Security Bulletin
ASB-2014.0007
A number of vulnerabilities have been identified in McAfee
Vulnerability Manager
17 January 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: McAfee Vulnerability Manager
Operating System: Windows Server 2003
VMware ESX Server
Impact/Access: Cross-site Request Forgery -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2014-1473 CVE-2014-1472
Member content until: Sunday, February 16 2014
OVERVIEW
A number of vulnerabilities have been identified in McAfee
Vulnerability Manager 7.0.11, 7.5.4 and 7.5.5. [1]
IMPACT
The vendor has provided the following details regarding these
vulnerabilities:
"XSS: Several web pages presented by the MVM Enterprise Manager are
susceptible to Reflected Cross-Site Scripting (XSS) attacks by
modification of the HTTP request. These vulnerabilities could allow
arbitrary HTML code to be reflected in the response web page.
However, these attacks generally require standing up a
man-in-the-middle (MITM) system to capture and modify specific
requests, which are then forwarded by the MITM to the actual
Enterprise Manager web site. The modified request is not stored, so
cannot be replayed later nor be used to inject HTML code into
another users browser session. Another vector of attack involves a
specifically crafted HTML link, sent via email or by other
electronic means, which once clicked could be used to execute
arbitrary HTML code in the users browser.
CSRF: Several web pages presented by the MVM Enterprise Manager web
site are susceptible to Cross-Site Request Forgery (CSRF) attacks by
modification of the HTTP request. These vulnerabilities could allow
arbitrary HTML code to be reflected in the response web page.
However, these attacks generally require standing up a
man-in-the-middle system, to capture and modify specific requests,
which are then forwarded by the MITM to the actual Enterprise
Manager web site. The modified request is not stored, so cannot be
replayed later nor be used to inject HTML code into another users
browser session." [1]
MITIGATION
The vendor has released hotfixes to correct these issues:
"For MVM 7.5.5:
7.5.5.05002_EM
For MVM 7.5.4:
7.5.4.05007_EM
For MVM 7.0.11:
7.0.11.05002_EM" [1]
REFERENCES
[1] McAfee Security Bulletin McAfee Vulnerability Manager hotfixes
remediate XSS and CSRF vulnerabilities reported by NATO
https://kc.mcafee.com/corporate/index?page=content&id=SB10061
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUtiUWhLndAQH1ShLAQIJphAAtOtEoZCyoLsHx5Ve5BkDP852IwHIhA2e
Wadg9aMOTg6mVtn9zWXrkhfulQzI/ljT0JLZi+TMYNixHMFoAeHGR++1GDWvIC4A
yDz2Mt6SbyP6xmhkp7u0I7NDqwgA6bN0djl0vgAoahF06G1Ch2kk+itKTuH3jTXr
6upmNW+4uBMrbjlfQh75ivVsdCFc9i338KDRMwEVUUulIG4JOECmX7Zdb4bUK+A3
J8GRd2cvk9I/TIxVZNthdOOm1Py/HJpF+7ooI5f7cayPf7m2yscRrXAEOF7VThJe
BsvNO9vb6Aqnmag+QlOQGpnBv3nPT2u/mivk84lt59bORBY+AqHZkwFGYupxXXEu
haGeCvEWn8Q6Z7vgg564FqTHl6irjOiyeFWJXFlMkOamdf5sR6HQgsdvuAEHMxbx
ewvorRL1lu3GhZ03WitGBFDWqDp1jOLbEJPYmMOs0Mgvd8dPzlWCV5iqxo26uRto
cHJFKsXT9drpijCJaSUqyhvXw0igocBZrKlAtn0cy8H3DX94Rx368OQ1iu9ipRwC
0PdhIMp8i4Zww0nkNoF67+TA1rFNnMVFGruRcmpklVy8JgAalw5v8rSDf7eMsTDy
xxCbDPiRCCWYr3jPUtMZTqiFj/62eg/pRnc0d/Br8+sfBDk/LZ7+F0g/NB3UAjTa
Jrzv+pAoz64=
=SCCw
-----END PGP SIGNATURE-----