McAfee Framework Remote Format-String Vulnerability

vendor:

Framework

by:

SecurityFocus

7.5

CVSS

HIGH

Format-String

134

CWE

Product Name: Framework

Affected Version From: 3.6.0.574 (Patch3)

Affected Version To: 4

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

McAfee Framework Remote Format-String Vulnerability

McAfee Framework is prone to a remote format-string vulnerability. Exploiting this issue will allow attackers to execute arbitrary code with the permissions of the framework or of an application that uses the framework. Failed attacks will likely cause denial-of-service conditions. McAfee Common Managemetn Agent 3.6.0.574 (Patch3) or earlier, McAfee Agent (MA) 4.0, Framework 2.6.0.569 and ePolicy Orchestrator 4.0 are vulnerable to this issue; other versions may also be affected. NOTE: This issue occurs only when the default debug level (7) is raised to 8.

Mitigation:

Raise the debug level to 8.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/28228/info

McAfee Framework is prone to a remote format-string vulnerability.

Exploiting this issue will allow attackers to execute arbitrary code with the permissions of the framework or of an application that uses the framework. Failed attacks will likely cause denial-of-service conditions.
McAfee Common Managemetn Agent 3.6.0.574 (Patch3) or earlier, McAfee Agent (MA) 4.0, Framework 2.6.0.569 and ePolicy Orchestrator 4.0 are vulnerable to this issue; other versions may also be affected.

NOTE: This issue occurs only when the default debug level (7) is raised to 8. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31399.zip