Information disclosure in McAfee ePolicy Orchestrator

Published: 2018-06-25

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2018-6672 CVE-2018-6671
CWE-ID	CWE-401 CWE-284
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #2 is available.
Vulnerable software	McAfee ePolicy Orchestrator Server applications / Directory software, identity management
Vendor	McAfee

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Memory leak

EUVDB-ID: #VU13450

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-6672

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information.

The vulnerability exists due to memory leak. A remote attacker can view potentially sensitive information in plain text.

Mitigation

Update to version 5.3.3, 5.9.1.

Vulnerable software versions

McAfee ePolicy Orchestrator: 5.3.0 - 5.9.0

CPE2.3

External links

https://kc.mcafee.com/corporate/index?page=content&id=SB10240

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU13451