{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-03-12T00:00:00", "descriptions": [{"lang": "en", "value": "Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "3748", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/3748"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://knowledge.mcafee.com/article/234/615103_f.sal_public.html"}, {"name": "mcafee-framework-format-string(41178)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41178"}, {"name": "1019609", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1019609"}, {"name": "29337", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/29337"}, {"name": "28228", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/28228"}, {"tags": ["x_refsource_MISC"], "url": "http://aluigi.altervista.org/adv/meccaffi-adv.txt"}, {"name": "ADV-2008-0866", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/0866/references"}, {"name": "20080312 Format string in McAfee Framework 3.6.0.569 (ePolicy Orchestrator 4.0)", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/489476/100/0/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-1357", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "3748", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/3748"}, {"name": "https://knowledge.mcafee.com/article/234/615103_f.sal_public.html", "refsource": "CONFIRM", "url": "https://knowledge.mcafee.com/article/234/615103_f.sal_public.html"}, {"name": "mcafee-framework-format-string(41178)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41178"}, {"name": "1019609", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1019609"}, {"name": "29337", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/29337"}, {"name": "28228", "refsource": "BID", "url": "http://www.securityfocus.com/bid/28228"}, {"name": "http://aluigi.altervista.org/adv/meccaffi-adv.txt", "refsource": "MISC", "url": "http://aluigi.altervista.org/adv/meccaffi-adv.txt"}, {"name": "ADV-2008-0866", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/0866/references"}, {"name": "20080312 Format string in McAfee Framework 3.6.0.569 (ePolicy Orchestrator 4.0)", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/489476/100/0/threaded"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-1357", "datePublished": "2008-03-17T17:00:00", "dateReserved": "2008-03-17T00:00:00", "dateUpdated": "2018-10-11T19:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:agent:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "43953695-9C35-4CC3-9591-D03866731F47", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:cma:3.0.6.453:*:*:*:*:*:*:*", "matchCriteriaId": "9B7D230B-845A-4E83-B86C-000CDBAC937F", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:cma:3.5.5.438:*:*:*:*:*:*:*", "matchCriteriaId": "4A0590CC-B03B-472B-A5FF-F6A316DBE2DC", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:cma:3.6.438:*:*:*:*:*:*:*", "matchCriteriaId": "0BD368FB-2683-4321-9491-CB757511AD49", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:cma:3.6.453:*:*:*:*:*:*:*", "matchCriteriaId": "F64F9F3F-F835-4769-9A5B-A05ED2AE7850", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:cma:3.6.546:*:*:*:*:*:*:*", "matchCriteriaId": "3C0AE0A0-E56A-4B93-B45B-037C09EA69C3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:cma:3.6.574:*:*:*:*:*:*:*", "matchCriteriaId": "CFF00F5B-4272-49CC-A9CE-4CCD20F5DB3E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "485DB16F-730A-44B2-A255-2583AB27DB9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:mcafee_framework:3.6.569:*:*:*:*:*:*:*", "matchCriteriaId": "6330056D-1DAF-4821-90E5-1E9E52594A25", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8."}, {"lang": "es", "value": "Vulnerabilidad en el formato de cadena en la funci\u00f3n logDetail de applib.dlld en McAfee Common Management Agent (CMA) 3.6.0.574 (Parche 3) y anteriores, como se utiliza en ePolicy Orchestrator 4.0.0 build 1015, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda) o ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de formatos de especificadores de formatos de cadena en un fichero de env\u00edo en una solicitud AgentWakeup en el puerto 8082. NOTA: esta vulnerabilidad s\u00f3lo sucede cuando se est\u00e1 en un nivel 8 de depuraci\u00f3n."}], "id": "CVE-2008-1357", "lastModified": "2018-10-11T20:31:59.903", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 5.4, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2008-03-17T17:44:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://aluigi.altervista.org/adv/meccaffi-adv.txt"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/29337"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/3748"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/489476/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/28228"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1019609"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2008/0866/references"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41178"}, {"source": "cve@mitre.org", "url": "https://knowledge.mcafee.com/article/234/615103_f.sal_public.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-134"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}