Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT Security Bulletin ASB-2018.0294 McAfee Security Bulletin - ePolicy Orchestrator update fixes Tomcat vulnerability 29 November 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: McAfee ePolicy Orchestrator Operating System: Virtualisation Impact/Access: Provide Misleading Information -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2018-11784 Member content until: Saturday, December 29 2018 Reference: https://kc.mcafee.com/corporate/index?page=content&id=SB10257 OVERVIEW McAfee has addressed a Tomcat vulnerability which affects ePolicy Orchestrator (CVE-2018-11784). [1] IMPACT McAfee has provided the following information about the vulnerability: "ePO runs on Apache Tomcat and as per the CVE listed below, the Tomcat update consumed by ePO is possibly vulnerable to invalidated redirects to any URI of an attacker's choice. This ePO update resolves the following issue: CVE-2018-11784 When the default servlet returned a redirect to a directory (for example, redirecting to /foo/ when the user requested /foo) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attacker's choice. Affected Component: ePO web core services" [1] MITIGATION McAfee advises: "To remediate this issue: Users of ePO 5.3.2 or earlier are recommended to upgrade to ePO 5.3.3, 5.9.1, or 5.10 and apply the fix for the version you upgraded to. See the table below for the relevant fix. Users of ePO 5.9.0 are recommended to upgrade to ePO 5.9.1 or 5.10 and apply the fix for the version you upgraded to. See the table below for the relevant fix. Users of ePO 5.3.3 are recommended to apply EPO533HF1257674.zip. Users of ePO 5.9.1 are recommended to apply EPO591HF1260432.zip. Users of ePO 5.10 are recommended to apply ePO 5.10 Update 2. " [1] REFERENCES [1] McAfee Security Bulletin - ePolicy Orchestrator update fixes Tomcat vulnerability (CVE-2018-11784) https://kc.mcafee.com/corporate/index?page=content&id=SB10257 AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBW/9+SWaOgq3Tt24GAQjVUg/+L7M7h9wUCxK1tqBYoclCqNjk+qNybsed 10R45QJJF8CrZI8uaZgVPPemSFeby4XD5SsZtSWZoxLP5kRqv3KGQNIZMKeZqiyn W+p3v7Wmb6wCssyIKR377DpXdKyTvfgO8gvnphogIxG88FXZPURtEBoVjGcJAv1v u8lh2AoXpehGvZNrJuxdQsi0XkoCj7Wx829hQ7U5UvoAZFhsFVFoVVQU+3MMTA1v rPPZSHAco9q/GyJTAC9hk/Use7VBdPiZy3UGb5wKtffcrSU0Fh7zDsO+9g+tmp+g ZH3k5q+YnBP0EJrXjevMF8iljdfqTHWtY3jt8wEEe00iH5UEui/dz89mQnf26Rsk Pb+5+W2Jcc3sWexElfmYXCdyrNmVBx0jby1LYzX9qGYmDHIYyo2kJe5ZvC5B+ppL hP0buOdBNKGd9NZA8zXT20MZ7xRpeniUvVqDbt52Sq4qAm/MK0R8FqlxSYxhhtf8 8VtL/mVkXbhV5kiTs2p4QROIBnUTFz/N5qK4eiMsNBN8WkJkk3POQ0ix+2toc04C 0FL+8K/WwS1fdNdsNzpd7Dg2+54T4WItSLxwgnLZRlF5/7GX8JKjmk//1wqNMWUZ IQxr5brU27MYZh2LgNK67nFMDNvY5LRuT/739bC4DpkIvDyaVrBAwr/wtkxFdAK2 ikXiK3t35sY= =K98d -----END PGP SIGNATURE-----