This is a multi-part message in MIME format.

------_=_NextPart_001_01C6A76B.36DB866F
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

McAfee ePolicy Orchestrator Remote Compromise

Release Date:
July 13, 2006

Severity:
High (Remote Code Execution)

Vendor:
McAfee

Systems Affected:
McAfee Common Management (EPO) Agent versions below version 3.5.5.438

Overview:
McAfee ePolicy Orchestrator is the remote security management software
for the McAfee enterprise product suite. EPO allows you to configure and
enforce protection policies, deploy and configure agents, and monitor
security status from a centralized console. 

eEye Digital Security has discovered a serious flaw within the Framework
Service component of the McAfee EPO management console. The Framework
service is enabled and running by default on all servers and agents. The
framework service listens by default on port 8081 and accepts requests
over the HTTP protocol. The framework service allows for remotely
submitting configuration and update changes. Each request is encrypted,
SHA-1 hashed and DSA signed, and written to a file on disk. Due to a
directory traversal attack, it is possible to write any file with any
contents to anywhere on the remote system. 

This flaw allows a remote attacker to anonymously compromise an affected
system and execute code within the SYSTEM context.

Additional Commentary:
This vulnerability was discovered by McAfee and eEye Digital Security,
individually of each other. McAfee had silently fixed this
vulnerability, prior to the discovery by eEye. It is good for any
software company to be proactive in trying to secure their software.
However, it is equally important for software vendors to create a
separation of security and features when providing updates. In this
case, fixing an extremely critical vulnerability without the proper
notification is a disservice to customers. The mindset of most
customers, especially when dealing with agent software, is to use what
works. This creates a scenario where organizations would potentially
choose to stick with their current deployments, rather than re-deploying
hundreds, if not thousands, of new agents for what would appear to
solely contain innocuous feature updates. We hope organizations take
note and verify they do indeed have the latest ePO framework installed,
and if not, update as soon as possible. -Marc Maiffret

Technical Details:
The framework service accepts POST requests over the /spipe/pkg
interface. These POST requests contain a header which indicates the type
of package request, UUID, and computer hostname. Depending on the
request, the block that follows may contain data specific to that
request. In the case of this vulnerability, the type of request
(PackageType) is "PropsResponse". The data that follows first specifies
a directory and xml filename, and is followed by the contents of the xml
file. Due to improper sanity checking on the directory and filename, it
is possible to use a directory traversal attack to write a user defined
filename, with user defined contents, anywhere on the system. 
A factor that would hinder exploitation is the fact that the file is
immediately deleted after use - this problem can be overcome by
increasing the file data length field to exceed the actual data length.

Each package request is obfuscated by XOR'ing the package data with the
static byte 0xAA, and is then SHA-1 hashed and DSA signed.

The vulnerable package format follows:

+00h WORD magic = "PO" (0x4F50)
+02h DWORD = 20000001h, 20001001h, or 30000001
+06h DWORD file offset of XML
+0Ah [E0h] fixed-length data
+0Ah DWORD 
+0Eh DWORD 
+12h DWORD length of XML
+16h [40h] ASCII ??? GUID
+56h [40h] ASCII ??? GUID
+96h DWORD 
+9Ah [???] ASCII host name
...

+EAh [...] name-value pairs
X+00h DWORD length of following name string
+04h [...] ASCII name string (no null terminator)
X+00h DWORD length of following value data
+04h [...] value data (null terminated if ASCII string)

X+00h [...] XML
+00h WORD 
+02h WORD length of following file name string 
+04h [...] ASCII .xml file name string * traversal attack, may be any
directory and file extension
X+00h DWORD length of following XML * increase length to prevent
deletion
+04h [...] ASCII XML * filename data

X+00h DWORD length of signature data = 2Ch
+04h WORD (big-endian) number of bits in DSA signature 'r' component
+06h [14h] DSA signature 'r' component (technically it's
variable-length)
+1Ah WORD (big-endian) number of bits in DSA signature 's' component
+1Ch [14h] DSA signature 's' component (also variable-length)

The package may be modified to generate any file, anywhere on the
system, with any extension. 

Exploitation is 100% reliable due to the fact we are merely taking
advantage of functions already implemented within the framework service.

Protection:
Retina - Network Security Scanner - has been updated to identify this
vulnerability.
Blink - Endpoint Vulnerability Prevention - preemptively protects from
this vulnerability.

Vendor Status:
McAfee customers must login to the McAfee customer website and download
version 3.5.5.438 or higher of the Common Management Agent (ePO
Framework) and upgrade existing ePO agent deployments. 

For more information, McAfee has published a knowledgebase article,
which can be found here.
https://secure.nai.com/us/forms/downloads/upgrades/login.asp

Credit:
Barnaby Jack
Additional Research: Derek Soeder

Related Links:
Retina Network Security Scanner - Free Trial
Blink Endpoint Vulnerability Prevention - Free Trial

Greetings:
Derek (props!), D R E, Carlos, the Samyo's, MereMac, Big Smooth and the
rest of the boys from R-Block.

Copyright (c) 1998-2006 eEye Digital Security
Permission is hereby granted for the redistribution of this alert
electronically. It is not to be edited in any way without express
consent of eEye. If you wish to reprint the whole or any part of this
alert in any other medium excluding electronic medium, please email
alert@eEye.com for permission. 

Disclaimer
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are no warranties, implied or express, with regard to this information.
In no event shall the author be liable for any direct or indirect
damages whatsoever arising out of or in connection with the use or
spread of this information. Any use of this information is at the user's
own risk.

------_=_NextPart_001_01C6A76B.36DB866F
Content-Type: application/ms-tnef;
	name="winmail.dat"
Content-Transfer-Encoding: base64

eJ8+IiQRAQaQCAAEAAAAAAABAAEAAQeQBgAIAAAA5AQAAAAAAADoAAEIgAcAGAAAAElQTS5NaWNy
b3NvZnQgTWFpbC5Ob3RlADEIAQ2ABAACAAAAAgACAAEEgAEANAAAAEVFWUU6IE1jQWZlZSBlUG9s
aWN5IE9yY2hlc3RyYXRvciBSZW1vdGUgQ29tcHJvbWlzZQCCEgEFgAMADgAAANYHBwAOAAoAHgAf
AAUAPgEBIIADAA4AAADWBwcADgAKAB4AIwAFAEIBAQmAAQAhAAAANDQ0MEEwMjU1ODQ3MUE0Rjg3
RDg0ODg1MzMwOUUxMDYA1wYBA5AGAGgUAAAxAAAACwACAAEAAAADACYAAAAAAAMANgAAAAAAQAA5
AMBgwDRrp8YBHgA9AAEAAAABAAAAAAAAAAIBRwABAAAAOwAAAGM9VVM7YT0gO3A9ZUV5ZSBEaWdp
dGFsIFNlYztsPUFWLU1BSUwwMS0wNjA3MTQxNzMwMzVaLTQ0NTcAAB4AcAABAAAANAAAAEVFWUU6
IE1jQWZlZSBlUG9saWN5IE9yY2hlc3RyYXRvciBSZW1vdGUgQ29tcHJvbWlzZQACAXEAAQAAABYA
AAABxqdrNL1C7lXhrGhGFqIC96uWlPSzAAAeABoMAQAAABAAAABlRXllIEFkdmlzb3JpZXMAHgAd
DgEAAAA0AAAARUVZRTogTWNBZmVlIGVQb2xpY3kgT3JjaGVzdHJhdG9yIFJlbW90ZSBDb21wcm9t
aXNlAAIBCRABAAAAWg4AAFYOAACPGwAATFpGdWTWcKwDAAoAcmNwZzEyNeIyA0N0ZXgFQQEDAfdP
CoACpAPjAgBjaArAc/BldDAgBxMCgA/zAFB/BFYIVQeyEcUOUQMBEMcy9wYABsMRxTMERhDJEtsR
09sI7wn3Oxi/DjA1EcIMYM5jAFALCQFkMzYRUAumEQXQY0FmCeAgZVDDBvAN4HkgT3IQ4AeQkHRy
YXQFsVJlBGCzDrASwW1wA2EEAGUKokcKhAqAH1BsZWERICASRB8AZTogZEp1bCEeYDEzLCAB0DA2
SyBqBmB2BnF0eSHlSGBpZ2ggKB9XAQAgREV4BZB1dGkCICn1IGpWCfBkBbAh5R2UIyu+eR7QH2AE
IB2wHcBjDrBeZCe7H7IEYAOgTQBwYQ5nH2AJ8AVAKEVQT/4pEWAr0CwRJAEAkAIgBCAaYiEwbwfg
LQUgMy6iNS6BNDM4IGpPJAF6dgiQdypMHg8fEgQAIPp0HrAgGMAfcxEgJiAkIqYgA4ErxnNvAYB3
CsD/MQACEAXAMqIwtgIwBJAf8LUgMSAf8WQbcDRxdSQw7GUuJeAsYCAHQC2xBCAmeQhgMpBvIAWg
bmZvJOAIcDEAAHBkNgE1IWNvNqMOsCoALjJwMUIIkHP3IsABAAtQbx5gOXI42Syy/ztROXIrUSQw
BbEzVx7QHwD+dQQgA1I34DjALAEe8DFQfnoJgDjCNJAhQDeQIGpl/EV5IYEk4CQwB0AGUTN1+xDw
BCBkBAAFoCQBQBE/YP8RIAUQCGA+8QtgB+AD8DKgWwuAMpNGHvAHgHcFsGv/BlIwADoBBaAf4AIg
LAI0oO81WjeyM+lAR1RFW0QBRlM/MnEJ8AGgIUBDwTmBcnVybgMAbmctgB5gAQFh/yJgRyEDoDfx
SnMtETljPNT/SYQDUEoOMVApYS1iTIs64EEAICA4MDgxTgRj7zoABTAEIBjAcQpQHtAEIENDcjKT
SFRUUDojb/8YMU6/RjU39TUiMuQicTdA/mIgIAJATDI41h8ALjI5cvh1cGQhsTjAEPBMQAeQvzeR
ANAlAFL1SvQFAHkFMMMJgCLAU0hBLVIQQvHjHrBLlERTQTNAJOBG8Ptb8TlydyQhUGE4kj9gOQDX
IUBNEkMxazeQRApQXqT/QzAYwCoABbAeYB7hLQJCMfMfAAGQY2siwCQwMmI64P0EEGlLYTiSXjI5
Uh5gXwN/RNJjozjRUGFSwV6yY8B3/x6wNPErYTKqKVNAvEmgMnH/RIM39T9gMuVhtFOiZXICIP8G
wERBInFGoiAEOWE34CnVP2b1OWQmA0aCJcFE2VNZsFNURU1kxA7QLiBq/EFkQzAmQkIxKyIsAQrA
uyRWaEN2ImBG8B7wYgMQ/zOiNNBDG0xxMLU5c0GvJDH7YhEncGkwADbwN/EeYEdB/yFQWpEfgGXR
N5AwtRDwbLH/XxECMCJxOQAmADmQRPFyrf8iwDZhNTI4sDKiQzYeYExxy3VyN5BJWyNnbwRwNRP/
Y7I0l0aiY7I4oS2QNrIA0O8mQCQAdtFhAXlMMjihM1PfYAEesGCANIc3kEgtwCPy/2IWUwF3Ywdw
UZIAcAVANSL/NJckACdyZUMFACFQY4IzQf8KsVjUR0EzVzlyMOA+wRjA/wQgZcE6wQNgdyFMMll0
TqH2SUUiMnFjIWEiwHnhTDL/A5EOwTLhV2IFASZAi2ADIL9yzUThCGAFQDKiH/FwEyH/arAmQDkA
i2A6kzJxYFIEEP9GNTiiPuAfEAeAERBJhCAg/ydwESFHMgRgWxGRpyLAB5D/j2A7IHdjiWMBAD/R
TEFkRP8sszSWYhFlQz7gZCEQ8AVA/0XSTqOLMoajaTIE8EsxRCHziVJl8nJnAHA/8FjTiUH9CGBs
OZA64GUClJQQ4H3w/yFxgWKNMUYAZEOCBDNxGMD/LBE7hCvyO1Ee8WXRMpEDka0YwC07hEwyaEwA
ZBjB/ztRBpCPkjKRREE5cTtRR0E/RvBowTzjNROXtZtSYXD/j2AKwYFiQIFrM3GxRRELgN9qsCYg
REOI5IpIV3jxj1G/mk0BkGowj5I5VCQCZmDx/x6wTIE4sHbhCeA5kBDwgJH/MqILYIqRBUAxIDfQ
VUgLgP8+oTgAXbahhCLAWXVDATSQ900iYng3kC0rkB6QK4EGkG8DUBEwZ4sFkGgDAI1SRPMRMAtw
bHNyB1UvVjJShW8sYG8gUu8xAC+UUAUgZfgvcGtMUAuANjFMwDoA/0mDIXG1bKWGP2AesHkgEyH/
ZcAN4CUAduKQAQeRMqIkQH+oAkdQCrBh8CvBtaYiwFX4VUlEPTRGom3BBcCOoP8e0CuwB4BfwTuQ
J2FMMmYn/7zlMqICYFSgRgCfwYTyOAT/AMClaFmRQ+GUYo/he9SX0f+1tYrFRoEhYkdDem+7e1rG
dChQvFRUu9EsgDJxXNAnOTNQj0FzH1CUUPctUSBQyXA0SYTC88FrOQA/ERA0ccNUmRNgeDlyeG3/
AyBfAr7CrcVWsjgCdGTFE/9k5kdFzjZfx4Rxj0SiMTOi/x6hYfC/ic1cznhiP5djYF//YWljGZdi
BcABAQuAQBHOeP9kQ9n7ZNY9MmW8ZwxdULfR/x8SwWObNEUBukIOwDuhQhH/kCYyot8iwVThs18S
MnEHcP8HgEMwIbEicQEAIUBskmxA+75Cl3ItxcQf8UthP0CLYP8DoH/xQ3JGocDhhFFbgSFR74Ej
4qbC83lxZ2RhzOGbYf84oQ7AOgB6E7TCPtBCMeiZ32/rWnO8TTJi5cBmPuC7IuF0c1hPUifnxrxG
wvMfnVY+k8OhTHAfkTB4Qf5BzvcyoQOgXC9dOG/rSaL/csZfIbxGNSEAwMGXIeUgZNYrIvAlAFfu
8EQz0UIA0bCgPSAiLGAiJRDxwLA0RjUwJoX4gDIlAJ5E+NP5gCLh+7IxaCLDt/wA+/QFsTP7tfgm
NvsGR18EASCS1VhNTPgmQaklAFtF+KBdedQt6OXvwvL/6fsk+CZFAp0OIPsGS+jl/4sx/jFbNACy
QUBTQ0lJID8HcCC2R71h+CU1Bo8Hmzn+N/8J5gBiB3EI5r6Cj5BFofgk9i4NUPfLRQBiDVEA0L7C
fC12lWBf8YdAzEH4JFj/+IME3sG0TDK+wj6RNnBMQP34JjQOdgkEElklEGqwj5D/ImDYsDYxkpEf
AiaFEF8Rbf8PRAHKE4cY2BUhFYpAEaGB/wkEEqQmixbUDpT/ufim+nm/F08R1l8DFHoZfwkELs42
/RRrKtgvXADCMuZhY7LUn/8xAW/AUHFxARZ/IO9MMv+x/yYB51VQEej0OKGPMIMxnlP/5DEplyOv
LCTOdgG5Kc8FKc9dcqbEGuP7gUNoLrn7M/IoczBnLb9ShNDJEBVw/m3mYH5Q/4FzMFLBRRFdNjGm
xCdyJ0aY/blbMe8TgAjgN69GmSjxkLIlhEJ8dCdyoZmhS1IBRfpmMe8CgTVvNn83j3M4rwSANJD/
Of9B3xUglWCFUD0/9K68Rv8nVZNA45DM4emTliFzAWOJv90PbMXbRWOyKTdnbEXgzf38kSVmgZVw
9gN3QGAD4bd/gyDNIH8RkfFXYqkRi/Nk/xqAuZG8kRGCoPCAYajSlWD9hqFkhFPl4S3x5GFuWbPP
/w17yaE8MXDysxXJ8HDwcSD95SFOsSCs43ZGdjDmIXLx/+Uh80F/4fKxilTpk4nwm8J3qjNyng11
QpVxrRDlMEXnhgA48LeBIFZy28mgLdP/TwLlMC2xaYC1IICBnCGPMb9YEs9ha6Fc/14H+CRWhfP/
djDhEaIgsxV4pZGnJ0CRsX2r0G/5QG6he/RmPVFBYufWoKmFhhB3bs+weSHYYhFPAjMuNWtBNDM4
+/zyboBnn4LRFXFir2GwwF9xIJYgcZII8JYjKKxSRu+spskQ87KKUGfYQNwA4KF/kNBZESIQrFKW
FJ6JTZxG/35Bk0B/EedQ9tRTwb0weKed1lF19hCQ0PNzIGuhsPZ3rZGWIGLFYqSwjTFKsn+6hOYl
fjCg8boBgsH4JGiz2ODJ0DovttCBoy4wwNRpLubRL6IgL/bSeoBfaiZ6gG+leoBnky5bQHDdsUpD
oSGOMLMVQqSwMMDt7rFK2QHepWR9sVPB2KF3yfGkodOQOr8RoSBZ4W+/44CT8LFKyfCr4vPQTF6x
v7MGWPVZj1qYbrB0gVRGMb5sXjpfH2AvhY+xlUdhYRdwYrMGgMQojzJzISnbvTD7YFKG8L0wQ6Sw
z7DL3PG/8lOssHlvPRB0IetR0bDAY70wQjqwZVCTQL+pcEyi6jShIO2h0RVinsB5YpVSLV6QwSEN
e2zgcC552YBsIMgxY8kQMTkoOTgt+6E26dBFef0pEEQ6sE7B2LCEdleFG6L/1pHhVEsy7rFvwVUD
o4K/9PvjkBTCYr4wTwLFpq1w2HD/rDGtkOIQ0sA8dcTB7bOhs7/pwOZhfaIcErnRJ9F3J2H/THKm
YKwx4MCQIblT5QAuAd//gZRCxMHRII4AdVVB82D/6aKFsNKwh1K/8ksgpSH88v9KUrFRkFWZh5yF
j2Hb0eNy/0Ag6dIaoL9zmhijtb0wVLHvxWJhgLLRmaRAnuPm0Zez/9LhliUNe5SQ7kCr4ONQgWbv
ytJzeVVI5XJh0uLCM/NA/xUAoNGdRZtxVuK9QMV5qrr/njJTsOqwu0K05FLQtLGXwv/XMpyDCPHE
0LIguXF/lMqz7zPhUYIVQZzwcpdSzPHV8b9UoUlSa9GdtdtFhbBngGD/6ZOuvsTDFUEt1PNgPKHq
RP++MAxg2+DmYU/ll8InyPzy/+BRuwQa4PkhzQFLIBYgReD/LdGhYdmA57Odcv+Bu2PCYv85EFgz
8GjXMmvRw0BUMq5//U1jQSfRv+PA308j4mXbsl89EWoxx8BwQJHmfcXgAAAeADUQAQAAAEcAAAA8
QTY0MUNFQUREQkFFQUU0Qzk2RkM1QkY4NTQ2OTUyNjgwMTJEREMxM0Bhdi1tYWlsMDEuY29ycC5p
bnQtZWV5ZS5jb20+AAADAIAQ/////x8A8xABAAAAdAAAAEUARQBZAEUAJQAzAEEAIABNAGMAQQBm
AGUAZQAgAGUAUABvAGwAaQBjAHkAIABPAHIAYwBoAGUAcwB0AHIAYQB0AG8AcgAgAFIAZQBtAG8A
dABlACAAQwBvAG0AcAByAG8AbQBpAHMAZQAuAEUATQBMAAAACwD2EAAAAABAAAcw+dXKNmunxgFA
AAgwi9TpNmunxgEDAN4/n04AAAMA8T8JBAAAHgD4PwEAAAAOAAAATWFyYyBNYWlmZnJldAAAAAIB
+T8BAAAAbgAAAAAAAADcp0DIwEIQGrS5CAArL+GCAQAAAAAAAAAvTz1FRVlFIERJR0lUQUwgU0VD
VVJJVFkvT1U9RklSU1QgQURNSU5JU1RSQVRJVkUgR1JPVVAvQ049UkVDSVBJRU5UUy9DTj1NTUFJ
RkZSRVQAAAAeAPo/AQAAABUAAABTeXN0ZW0gQWRtaW5pc3RyYXRvcgAAAAACAfs/AQAAAB4AAAAA
AAAA3KdAyMBCEBq0uQgAKy/hggEAAAAAAAAALgAAAAMA/T/kBAAAAwAZQAAAAAADABpAAAAAAB4A
MEABAAAAEAAAAGVFeWUgQWR2aXNvcmllcwAeADFAAQAAABAAAABlRXllIEFkdmlzb3JpZXMAHgA4
QAEAAAAKAAAATU1BSUZGUkVUAAAAHgA5QAEAAAACAAAALgAAAAMAW0AAAAAAAgFhQAEAAABVAAAA
RVg6L089RUVZRSBESUdJVEFMIFNFQ1VSSVRZL09VPUZJUlNUIEFETUlOSVNUUkFUSVZFIEdST1VQ
L0NOPVJFQ0lQSUVOVFMvQ049TU1BSUZGUkVUAAAAAAMAdkD/////AwAJWQEAAAALAIeBCCAGAAAA
AADAAAAAAAAARgAAAAAOhQAAAAAAAAMA64EIIAYAAAAAAMAAAAAAAABGAAAAAAGFAAAAAAAACwDw
gQggBgAAAAAAwAAAAAAAAEYAAAAAA4UAAAAAAAADAPqBCCAGAAAAAADAAAAAAAAARgAAAAAQhQAA
AAAAAAMAAYIIIAYAAAAAAMAAAAAAAABGAAAAABiFAAAAAAAACwAgggggBgAAAAAAwAAAAAAAAEYA
AAAABoUAAAAAAAALACGCCCAGAAAAAADAAAAAAAAARgAAAACChQAAAAAAAAsAKQAAAAAACwAjAAAA
AAADAAYQW4zFQgMABxBIFAAAAwAQEAAAAAADABEQAQAAAB4ACBABAAAAZQAAAE1DQUZFRUVQT0xJ
Q1lPUkNIRVNUUkFUT1JSRU1PVEVDT01QUk9NSVNFUkVMRUFTRURBVEU6SlVMWTEzLDIwMDZTRVZF
UklUWTpISUdIKFJFTU9URUNPREVFWEVDVVRJT04pVkUAAAAAAgF/AAEAAABHAAAAPEE2NDFDRUFE
REJBRUFFNEM5NkZDNUJGODU0Njk1MjY4MDEyRERDMTNAYXYtbWFpbDAxLmNvcnAuaW50LWVleWUu
Y29tPgAAx2c
------_=_NextPart_001_01C6A76B.36DB866F--