Document Title: =============== McAfee Web Gateway 6.8.6.x - Multiple Web Vulnerbilities References (Source): ==================== MFE-WGW-20100429-01 Release Date: ============= 2011-08-10 Vulnerability Laboratory ID (VL-ID): ==================================== 73 Product & Service Introduction: =============================== Enter McAfee Web Gateway—the #1-rated anti-malware solution for Web 2.0 and zero-day threats. For user-initiated web requests, Web Gateway first enforces an organization’s Internet use policy. For all allowed traffic, it then uses local and global techniques to analyze the nature and intent of all content and active code entering the network via requested web pages, providing immediate protection against malware and other hidden threats. And unlike basic packet inspection techniques, McAfee Web Gateway can even perform deep examination of SSL traffic to protect against malicious code that has been disguised via encryption. The comprehensive McAfee Web Gateway solution comprises: Proxy/cache Category and reputation-based web filtering Anti-malware McAfee Anti-Virus Anti-spyware SSL scanning Data leakage protection Reporting (Copy of Vendor Homepage: http://www.mcafee.com/us/enterprise/products/email_and_web_security/web/web_gateway.html) Abstract Advisory Information: ============================== Vulnerability-Lab Team discovered multiple persistent Vulnerabilities on McAfee Web Gateway. Vulnerability Disclosure Timeline: ================================== 2011-08-11: Public or Non-Public Disclosure Discovery Status: ================= Published Affected Product(s): ==================== Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ Multiple Input Validation Vulnerabilities are detected on McAfee Web Gateway 6.8.6. Remote attackers & local privileged user accounts can include/implement own malicous persistent script codes on to manipulate specific module request & can lead to session hijacking (customer/admin). Low privileged accounts can include persistent frame requests to access with the same rights the log- or static-files. Vulnerable Module(s): [+] Account Overview - Allows to manage the accounts [+] HMS AGENTS - Private Key Handling / Remote Service [+] Secure Administration Shell - General Settings - Ciphers|Protocol Options [+] E-Mail Gateway & HTTP Method Filter List [+] Incident Manager Pictures: ../1.png ../2.png ../3.png Proof of Concept (PoC): ======================= This vulnerabilities can be exploited by local or remote attackers. For demonstration or reproduce ... Code Review: Account Overview

Found no entry with '>", >"'

Select

Account

Role

Filter:

" type="text" size="40" maxlength="255" onkeypress="return listFilterKey(document.form, event, '');">

Select All

Code Review: HMS AGENTS - Private Key Handling

Decrypting of handshake data will be done
		by this McAfee Web Gateway instance
		by remote service using HSM Agent with key " name="HTTPSProxy.PrivateDomainKeyName">
	Send certificate chain in handshake

Code Review: Secure Administration Shell - General Settings - Ciphers|Protocol Options

...or

Session encryption ciphers:	"> (Format: Method [, Method]*)
Message authentication algorithms:	(Format: Method [, Method]*)
Message authentication algorithms:	"> Code Review: HTTP Method Filter List

Found no entry with 'INCLUDE OWN SCRIPTCODE HERE!, *, *, *'

Select

Method

URL

Category

Action

Cont.

Description

Filter:

" type="text" size="20" maxlength="255" onkeypress="return listFilterKey(document.form, event, '');">

Select All

References: http://127.0.0.1:9090/conf http://127.0.0.1:9090/conf?navTo=SecureAdministrationShell&foo=1564980&userID=Emergency&session=vwpYjyP5GRsSL5v http://127.0.0.1:9090/conf?navTo=SSL2&foo=2367312&userID=asd&session=vwpYjyP5GRsSL5v http://127.0.0.1:9090/conf?Search=foo&session=oPu/uG910Mew9q6&searchUI= Security Risk: ============== The security risk of the persistent vulnerabilities are estimated as medium. Credits & Authors: ================== Vulnerability Research Laboratory Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright © 2012 | Vulnerability Laboratory