CVSS: 5.0EPSS: 89%CPEs: 1EXPL: 3CVE-2008-1855 – Mcafee EPO 4.0 - 'FrameworkService.exe' Remote Denial of Service
https://notcve.org/view.php?id=CVE-2008-1855
FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot (PrP), allows remote attackers to corrupt memory and cause a denial of service (CMA Framework service crash) via a long invalid method in requests for the /spin//AVClient//AVClient.csp URI, a different vulnerability than CVE-2006-5274. FrameworkService.exe en McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 y anteriores, usado por ePolicy Orchestrator (ePO) y ProtectionPilot (PrP), permite a atacantes remotos corromper la memoria y provocar una denegación de servico (caída del servicio CMA Framework) a través de un método largo inválido en una petición al URI /spin//AVClient//AVClient.csp. Vulnerabilidad distinta del CVE-2006-5274. • https://www.exploit-db.com/exploits/5343 http://secunia.com/advisories/29637 http://www.offensive-security.com/0day/mcafee_again.py.txt http://www.securityfocus.com/bid/28573 http://www.securitytracker.com/id?1019794 http://www.vupen.com/english/advisories/2008/1122/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41597 https://knowledge.mcafee.com/article/219/615324_f.SAL_Public.html • CWE-399: Resource Management Errors •
CVSS: 5.4EPSS: 85%CPEs: 9EXPL: 3CVE-2008-1357 – McAfee Framework ePolicy 3.x - Orchestrator '_naimcomn_Log' Remote Format String
https://notcve.org/view.php?id=CVE-2008-1357
Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8. Vulnerabilidad en el formato de cadena en la función logDetail de applib.dlld en McAfee Common Management Agent (CMA) 3.6.0.574 (Parche 3) y anteriores, como se utiliza en ePolicy Orchestrator 4.0.0 build 1015, permite a atacantes remotos provocar una denegación de servicio (caída) o ejecutar código de su elección a través de formatos de especificadores de formatos de cadena en un fichero de envío en una solicitud AgentWakeup en el puerto 8082. NOTA: esta vulnerabilidad sólo sucede cuando se está en un nivel 8 de depuración. • https://www.exploit-db.com/exploits/31399 http://aluigi.altervista.org/adv/meccaffi-adv.txt http://secunia.com/advisories/29337 http://securityreason.com/securityalert/3748 http://www.securityfocus.com/archive/1/489476/100/0/threaded http://www.securityfocus.com/bid/28228 http://www.securitytracker.com/id?1019609 http://www.vupen.com/english/advisories/2008/0866/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41178 https://knowledge.mcafee.com/article/234/615103_f.sal& • CWE-134: Use of Externally-Controlled Format String •