Document Title:
===============
McAfee UTM Firewall Appliance - Multiple Web Vulnerbilities
References (Source):
====================
MFE-UTM-20100429-01 - McAfee Unified Threat Management (UTM) Firewall Appliance - 6.8.6 build 6257
Release Date:
=============
2011-08-11
Vulnerability Laboratory ID (VL-ID):
====================================
72
Product & Service Introduction:
===============================
McAfee UTM Firewall is a complete office network-in-a-box Internet security appliance for small and medium-size businesses (SMBs).
It features wide-area networking tools that you would normally only see with enterprise-class devices. Because the last thing SMBs
need is another single-purpose security appliance to add to their network.
Use your UTM Firewall as your all-in-one solution to easily set up your business office with:
* A local network of office PCs (wired or wireless, including DHCP and all LAN-routing functions)
* Secure connectivity to the Internet with web-based content filtering
* Seamless LAN to WAN connectivity with secure remote VPN access for your branch offices and mobile staff
* A complete perimeter security solution, with options such as firewall, VPN, IDS/IPS, anti-spam, and content filtering
UTM Firewall handles it all for you, easily and affordably. It works by converging all networking, firewall, intrusion prevention
security, and remote access requirements into one high-speed, highly reliable, small-form-factor appliance.
Just pick the UTM Firewall model that fits your business requirements and power it on. We have models ranging from our entry-level SOHO appliance,
to our rack mount unit intended for larger offices. No additional routers, switches, DHCP servers, wireless devices, or failover devices are needed.
All UTM Firewalls can be centrally managed via the McAfee UTM Firewall Control Center. Centralized management is critical to larger distributed
environments-it allows network administrators to manage hundreds or even thousands of UTM Firewall appliances with a click of the mouse, including
upgrades, policy changes, and other configuration tasks.
(Copy of the Vendor Homepage: http://www.mcafee.com/us/enterprise/products/network_security/utm_firewall.html)
Abstract Advisory Information:
==============================
Vulnerability-Lab Team discovered multiple persistent Web Vulnerabilities on McAfee UTM Firewall Appliance.
Vulnerability Disclosure Timeline:
==================================
2011-08-12: Public or Non-Public Disclosure
Discovery Status:
=================
Published
Affected Product(s):
====================
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
1.1
Multiple Input Validation Vulnerabilities are detected on McAfee Unified Threat Management (UTM) Firewall Appliance.
A remote attacker can implement malicious persistent script codes to manipulate specific firewall application requests or content.
Vulnerable Module(s):
[+] Diagnostics - Email System Log Delivery
[+] View Local System Log
[+] Debug Inseration
[+] Display/Modify Device Configuration
1.2
A persistent bug is detected on the application exception-handling of the utm firewall appliance.
The errors got re-displayed & allows to execute persistent & non-persistent script codes.
Vulnerable Module(s):
[+] McAfee Filter Exception-Handling
Pictures:
../1.png
../2.png
Proof of Concept (PoC):
=======================
The vulnerabilities can be exploited local low privileged user accounts or remote attackers. For demonstration or reproduce ...
Code Review: Diagnostics - Email System Log Delivery
Sender Email
@localhost.com" size="24" maxlength="500">
1
Filter Level
Code Review: View Local System Log
Error Detected
The entered data could not be validated. The following diagnostics were generated:
Failed validation on object syslog.target<1>: email.sender='>"@localhost.com'