McAfee HTTP Server Stack-Based Buffer Overflow Vulnerability and Attack Code

Vulnerability Key Information Overview A stack-based buffer overflow vulnerability exists in the McAfee HTTP server, which may allow a remote unauthenticated attacker to execute arbitrary code. Description The McAfee HTTP server (NAISERV.exe) is used in McAfee products such as McAfee ePolicy Orchestrator and Protection Pilot. This HTTP Server is vulnerable to a stack-based buffer overflow when processing malformed HTTP packets. More information is available in McAfee Security Bulletin 8611438. Public attack code targeting this vulnerability is available. Impact A remote unauthenticated attacker may be able to execute arbitrary code. Solution Apply a patch. The patch listed in McAfee Security Bulletin 8611438 resolves this vulnerability. Restrict access to the McAfee HTTP Server. You may wish to block access to the vulnerable software from outside your network perimeter, especially access to the ports used by the McAfee HTTP Server, which will reduce the risk of attack. However, blocking access at the perimeter still allows attackers within your network perimeter to exploit this vulnerability. Using host-based and network-based firewalls can restrict access to specific hosts within the network. It is important to understand your network configuration and service requirements when deciding what modifications to make. Vulnerability Information McAfee franchise CSR is affected. CVSS Score No CVSS score information available. References http://www.remote-exploit.org/advisories/mcafee-epo.pdf http://knowledge.mcafee.com/SupportSite/dynamickc.do?externalId=8611438&sliceId=SAL_Public&command=show&forward=nonthreadedKC&kctid=8611438 Acknowledgments The issue was submitted by muts. This document was written by Jeff Gennari. Additional Information CVE ID: None Severity Rating: 18.56 Disclosure Date: 2006-10-02 First Published Date: 2006-10-05

Goal Reached Thanks to every supporter — we hit 100%!

McAfee HTTP Server Stack-Based Buffer Overflow Vulnerability and Attack Code