-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.1073
ePolicy Orchestrator update addresses three vulnerabilities
(CVE-2021-23888, CVE-2021-23889, CVE-2021-23890)
29 March 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: McAfee ePolicy Orchestrator
Publisher: McAfee
Operating System: Windows
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-23890 CVE-2021-23889 CVE-2021-23888
Original Bulletin:
https://kc.mcafee.com/corporate/index?page=content&id=SB10352
- --------------------------BEGIN INCLUDED TEXT--------------------
McAfee Security Bulletin - ePolicy Orchestrator update addresses three
vulnerabilities (CVE-2021-23888, CVE-2021-23889, CVE-2021-23890)
Security Bulletins ID : SB10352
Last Modified : 3/25/2021
Summary
First Published: March 25, 2021
+----------------+----------+--------------+----------------+--------+--------+
| | | | | |CVSS |
| |Impacted | |Impact of |Severity|v3.1 |
|Product: |Versions: |CVE ID: |Vulnerabilities:|Ratings:|Base/ |
| | | | | |Temporal|
| | | | | |Scores: |
+----------------+----------+--------------+----------------+--------+--------+
| | | |CWE-938: | | |
| | |CVE-2021-23888|Unvalidated |Medium |6.3 / |
| |5.10 prior| |Redirects and | |5.7 |
| |to Update | |Forwards | | |
|ePolicy |10 +--------------+----------------+--------+--------+
|Orchestrator |5.9.1 | |CWE 79: | |3.5 / |
|(ePO) |prior to |CVE-2021-23889|Cross-Site |Low |3.2 |
| |HF | |Scripting (XSS) | | |
| |EPO-937000+--------------+----------------+--------+--------+
| | | |CWE-717: | |6.5 / |
| | |CVE-2021-23890|Information Leak|Medium |5.9 |
| | | |/Disclosure | | |
+----------------+----------+--------------+----------------+--------+--------+
| |Install or update to the versions listed below: |
|Recommendations:| |
| | o ePO 5.10.0 Update 10 |
| | o ePO 5.9.1 HF EPO-937000 |
+----------------+------------------------------------------------------------+
|Security | |
|Bulletin |None |
|Replacement: | |
+----------------+------------------------------------------------------------+
|Location of | |
|updated |http://www.mcafee.com/us/downloads/downloads.aspx |
|software: | |
+----------------+------------------------------------------------------------+
To receive email notification when this Security Bulletin is updated, click
Subscribe on the right side of the page. You must be logged on to subscribe.
Article contents:
o Vulnerability Description
o Remediation
o Additional steps required to address CVE-2021-23890
o Acknowledgments
o Frequently Asked Questions (FAQs)
o Resources
o Disclaimer
Vulnerability Description
1. CVE-2021-23888
Unvalidated client-side URL redirect vulnerability in McAfee ePolicy
Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO
user to load an untrusted site in an ePO iframe which could steal
information from the authenticated user.
This would require the attacker to convince the ePO user to click a
malicious link whilst logged into the ePO server through the same browser
they clicked on the malicious link in. The results of this attack are not
stored in ePO.
https://web.nvd.nist.gov/view/vuln/detailvulnId=CVE-2021-23888
https://cve.mitre.org/cgi-bin/cvename.cginame=CVE-2021-23888
2. CVE-2021-23889
Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO)
prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web
script or HTML via multiple parameters where the administrator's entries
were not correctly sanitized.
To exploit this the attacker would either:
Need to know an existing registered command in the ePO system which
they can pass parameters to, triggering the Cross-site scripting
vulnerability
Add a new registered command to the ePO system which does not sanitize
parameters. Adding a new command to the ePO system requires
administrator privileges and they must be logged onto the local ePO
system, not through the User Interface. This could then be exploited by
a another ePO user. Execution of these commands is not granted by
default to non-administrator ePO users.
https://web.nvd.nist.gov/view/vuln/detailvulnId=CVE-2021-23889
https://cve.mitre.org/cgi-bin/cvename.cginame=CVE-2021-23889
3. CVE-2021-23890
Information leak vulnerability in the Agent Handler of McAfee ePolicy
Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user
to download McAfee product packages (specifically McAfee Agent) available
in ePO repository and install them on their own machines to have it managed
and then in turn get policy details from the ePO server. This can only
happen when the ePO Agent Handler is installed in a Demilitarized Zone
(DMZ) to service machines not connected to the network through a VPN.
Once the software fix has been applied, further configuration changes are
required. See the Additional steps required to address CVE-2021-23890
section below.
https://web.nvd.nist.gov/view/vuln/detailvulnId=CVE-2021-23890
https://cve.mitre.org/cgi-bin/cvename.cginame=CVE-2021-23890
Remediation
To remediate this issue:
o Customers using ePO 5.10 should update to ePO 5.10.0 Update 10.
o Customers using ePO 5.9.x and earlier should upgrade to ePO 5.10.0 Update
10.
o Customers using ePO 5.9.x and earlier could apply ePO 5.9.1 HF EPO-937000
to resolve only CVE-2021-23890. McAfee strongly recommends upgrading ePO to
version 5.10 as the End of Life for ePO 5.9.1 has been announced as August
31, 2021. For more information, see: KB93286 - End of Life for ePolicy
Orchestrator 5.9.x .
Go to the Product Downloads site , and download the applicable product update/
hotfix file:
+-------+-------+------+--------------------+--------------+
|Product|Version|Type |File Name |Release Date |
+-------+-------+------+--------------------+--------------+
|ePO |5.9.1 |Hotfix|EPO-937000 |March 25, 2021|
+-------+-------+------+--------------------+--------------+
|ePO |5.10.0 |Update|ePO 5.10.0 Update 10|March 25, 2021|
+-------+-------+------+--------------------+--------------+
Download and Installation Instructions
For instructions to download McAfee product updates and hotfixes, see: KB56057
- - How to download Enterprise product updates and documentation . Review the
Release Notes and the Installation Guide for instructions on how to install
these updates. All documentation is available at https://docs.mcafee.com .
Additional steps required to address CVE-2021-23890
Apply these two settings changes after applying ePO 5.10.0 Update 10 or ePO
5.9.1 HF EPO-937000:
Setting 1: Stop auto-install of the agent into the ePO System Tree coming
through the DMZ.
1. On the remote ePO Agent Handler that is installed in a DMZ, navigate to the
Agent HandlerDB folder.
2. Edit the server.ini configuration file.
3. Add the setting DMZ=1 under the [Server] section and save the file.
Setting 2: Block download of McAfee Agent packages from DMZ installed ePO Agent
Handlers.
NOTE: The following instructions also prevent off-network/off-VPN McAfee Agents
from upgrading their McAfee Agent client software.
1. On the remote ePO Agent Handler that is installed in a DMZ, navigate to the
apache2conf folder.
2. Open the httpd.conf file.
3. Search for this line: require all denied
4. Add the following contents to below the location found in the previous step
3.
# Block agent package requests from being served by this agent handler
SetHandler none
Require all denied
5. Save the httpd.conf file.
6. Open Service Control Manager and restart the ePO 5.10 Server service.
Acknowledgments
McAfee credits the following for responsibly reporting these flaws:
CVE-2021-23888 - Ricardo Almeida (vibrio)
CVE-2021-23889 - Michal Skowron from ING Tech Poland
CVE-2021-23890 - Saulius Pranckevicius from Danske Bank Red Team
Frequently Asked Questions (FAQs)
How do I know if my McAfee product is vulnerable or not
For ePO/server products:
Use the following instructions for server-based products:
o Check the version and build of ePO that is installed. For instructions, see
KB52634 - How to determine what update is installed for ePO .
o Create a query in ePO for the product version of the product installed
within your organization.
What is CVSS
CVSS, or Common Vulnerability Scoring System, is the result of the National
Infrastructure Advisory Council's effort to standardize a system of assessing
the criticality of a vulnerability. This system offers an unbiased criticality
score between 0 and 10 that customers can use to judge how critical a
vulnerability is and plan accordingly. For more information, visit the CVSS
website at: https://www.first.org/cvss/ .
When calculating CVSS scores, McAfee has adopted a philosophy that fosters
consistency and repeatability. Our guiding principle for CVSS scoring is to
score the exploit under consideration by itself. We consider only the immediate
and direct impact of the exploit under consideration. We do not factor into a
score any potential follow-on exploits that might be made possible by the
successful exploitation of the issue being scored.
What are the CVSS scoring metrics
1. CVE-2021-23888: ePO unvalidated URL redirect vulnerability
+------------------------+--------------------+
|Base Score |6.3 |
+------------------------+--------------------+
|Attack Vector (AV) |Network (N) |
+------------------------+--------------------+
|Attack Complexity (AC) |Low (L) |
+------------------------+--------------------+
|Privileges Required (PR)|Low (L) |
+------------------------+--------------------+
|User Interaction (UI) |Required (R) |
+------------------------+--------------------+
|Scope (S) |Unchanged (U) |
+------------------------+--------------------+
|Confidentiality (C) |High (H) |
+------------------------+--------------------+
|Integrity (I) |Low (L) |
+------------------------+--------------------+
|Availability (A) |None (N) |
+------------------------+--------------------+
|Temporal Score (Overall)|5.7 |
+------------------------+--------------------+
|Exploitability (E) |Proof of Concept (P)|
+------------------------+--------------------+
|Remediation Level (RL) |Official Fix (O) |
+------------------------+--------------------+
|Report Confidence (RC) |Confirmed (C) |
+------------------------+--------------------+
NOTE: The below CVSS version 3.1 vector was used to generate this score.
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculatorvector=AV:N/AC:L/PR:L/
UI:R/S:U/C:H/I:L/A:N/E:P/RL:O/RC:C&version=3.1
2. CVE-2021-23889: ePO Cross-site Scripting vulnerability
+------------------------+--------------------+
|Base Score |3.5 |
+------------------------+--------------------+
|Attack Vector (AV) |Network (N) |
+------------------------+--------------------+
|Attack Complexity (AC) |Low (L) |
+------------------------+--------------------+
|Privileges Required (PR)|High (H) |
+------------------------+--------------------+
|User Interaction (UI) |Required (R) |
+------------------------+--------------------+
|Scope (S) |Unchanged (U) |
+------------------------+--------------------+
|Confidentiality (C) |Low (L) |
+------------------------+--------------------+
|Integrity (I) |Low (L) |
+------------------------+--------------------+
|Availability (A) |None (N) |
+------------------------+--------------------+
|Temporal Score (Overall)|3.2 |
+------------------------+--------------------+
|Exploitability (E) |Proof of Concept (P)|
+------------------------+--------------------+
|Remediation Level (RL) |Official Fix (O) |
+------------------------+--------------------+
|Report Confidence (RC) |Confirmed (C) |
+------------------------+--------------------+
NOTE: The below CVSS version 3.1 vector was used to generate this score.
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculatorvector=AV:N/AC:L/PR:H/
UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C&version=3.1
3. CVE-2021-23890: ePO Information Leak vulnerability
+------------------------+--------------------+
|Base Score |6.5 |
+------------------------+--------------------+
|Attack Vector (AV) |Network (N) |
+------------------------+--------------------+
|Attack Complexity (AC) |Low (L) |
+------------------------+--------------------+
|Privileges Required (PR)|None (N) |
+------------------------+--------------------+
|User Interaction (UI) |None (N) |
+------------------------+--------------------+
|Scope (S) |Unchanged (U) |
+------------------------+--------------------+
|Confidentiality (C) |Low (L) |
+------------------------+--------------------+
|Integrity (I) |Low (L) |
+------------------------+--------------------+
|Availability (A) |None (N) |
+------------------------+--------------------+
|Temporal Score (Overall)|5.9 |
+------------------------+--------------------+
|Exploitability (E) |Proof of Concept (P)|
+------------------------+--------------------+
|Remediation Level (RL) |Official Fix (O) |
+------------------------+--------------------+
|Report Confidence (RC) |Confirmed (C) |
+------------------------+--------------------+
NOTE: The below CVSS version 3.1 vector was used to generate this score.
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculatorvector=AV:N/AC:L/PR:N/
UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C&version=3.1
Where can I find a list of all Security Bulletins
All Security Bulletins are published on our external PSIRT website at https://
www.mcafee.com/us/threat-center/product-security-bulletins.aspx . To see
Security Bulletins for McAfee Enterprise products on this website click
Enterprise Security Bulletins . Security Bulletins are retired (removed) once a
product is both End of Sale and End of Support (End of Life).
How do I report a product vulnerability to McAfee
If you have information about a security issue or vulnerability with a McAfee
product, visit the McAfee PSIRT website for instructions at https://
www.mcafee.com/us/threat-center/product-security-bulletins.aspx . To report an
issue, click Report a Security Vulnerability .
How does McAfee respond to this and any other reported security flaws
Our key priority is the security of our customers. If a vulnerability is found
within any McAfee software or services, we work closely with the relevant
security software development team to ensure the rapid and effective
development of a fix and communication plan.
McAfee only publishes Security Bulletins if they include something actionable
such as a workaround, mitigation, version update, or hotfix. Otherwise, we
would simply be informing the hacker community that our products are a target,
putting our customers at greater risk. For products that are updated
automatically, a non-actionable Security Bulletin might be published to
acknowledge the discoverer.
View our PSIRT policy on the McAfee PSIRT website at https://www.mcafee.com/us/
threat-center/product-security-bulletins.aspx by clicking About PSIRT .
Resources
To contact Technical Support, log on to the ServicePortal and go to the Create
a Service Request page at https://support.mcafee.com/ServicePortal/faces/
serviceRequests/createSR :
o If you are a registered user, type your User ID and Password, and then
click Log In .
o If you are not a registered user, click Register and complete the required
fields. Your password and logon instructions will be emailed to you.
Disclaimer
The information provided in this Security Bulletin is provided as is without
warranty of any kind. McAfee disclaims all warranties, either express or
implied, including the warranties of merchantability and fitness for a
particular purpose. In no event shall McAfee or its suppliers be liable for any
damages whatsoever including direct, indirect, incidental, consequential, loss
of business profits or special damages, even if McAfee or its suppliers have
been advised of the possibility of such damages. Some states do not allow the
exclusion or limitation of liability for consequential or incidental damages so
the preceding limitation may not apply.
Any future product release dates mentioned in this Security Bulletin are
intended to outline our general product direction, and they should not be
relied on in making a purchasing decision. The product release dates are for
information purposes only, and may not be incorporated into any contract. The
product release dates are not a commitment, promise, or legal obligation to
deliver any material, code, or functionality. The development, release, and
timing of any features or functionality described for our products remains at
our sole discretion and may be changed or canceled at any time
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYGEgp+NLKJtyKPYoAQgWCRAAo7aQ+w41BSaClU9i4+GgDyXCTE8L81ZT
Pqdz138M0FD+CRhjQWIUdmJCUXN9GgDtKRcd9UWSq6faqvHWAQw1FYgdcfSsSFzb
lebAaSF2+jeny4KfUFa86A6yLT9Rx+Oj2oxGwJtBtJ3nNgq69RW2YPmJcop40/fQ
1za/KGOYCAfzTOMe5a2nqiPfujOuIsDkfDRzjJ+rwtK34EEhOrPpqlYepDJOj8Up
GvRbPbsBiKfl/9Fjn/DlUMjYfNdGxUtm8nmxPR5C4S66LwefsypCvxBGMyunvv8i
1w8eA3BnxVTBrzFIKLGgoxZX449sKuuWpAoQPRX9jexZSu2vh0YT/YALlcaSoC+Z
dMXfxpKnligKtcql7IGxRMWwWTcNL6gCngeltmrCMc43KO/MOH3Dp5Iwl7qJTIn8
MLMNGyyw6BMZo7HK1qWsQLQeLVVEk6+w8iJ5TZ1EfK5jKbkmq5fug5zmfj3jSsv3
xgzFemvfAPbvea+HjIid2Kshu5457TK7geutIYg/+T6BRUeHoRS4kszu+HC0C3RL
ajTwz+mECPf7aCdsdxPMFxfSZNoVLjVNSMA2pg4K5Y0eKRv7cBovlUDf7zmGjUDQ
U+cNOQmnh/6RVT9XZ7Hkel3bAKjPmRAxsSF/UBalOouUcX3BgeoNmeB7SJm/1wwA
CKcoD1zeG6s=
=cuCK
-----END PGP SIGNATURE-----
The post ESB-2021.1073 – [Win] McAfee ePolicy Orchestrator: Multiple vulnerabilities appeared first on Malware Devil.
https://malwaredevil.com/2021/03/29/esb-2021-1073-win-mcafee-epolicy-orchestrator-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-1073-win-mcafee-epolicy-orchestrator-multiple-vulnerabilities
