Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2008-1357

Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8.

Published

2008-03-17T17:44:00.000

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.4 (MEDIUM)

CVSSv2 Vector

AV:N/AC:H/Au:N/C:N/I:N/A:C

  • Access Vector: NETWORK
  • Access Complexity: HIGH
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: COMPLETE
Exploitability Score

4.9

Impact Score

6.9

Weaknesses
  • Type: Primary
    CWE-134
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mcafee agent 4.0 Yes
Application mcafee cma 3.0.6.453 Yes
Application mcafee cma 3.5.5.438 Yes
Application mcafee cma 3.6.438 Yes
Application mcafee cma 3.6.453 Yes
Application mcafee cma 3.6.546 Yes
Application mcafee cma 3.6.574 Yes
Application mcafee epolicy_orchestrator 4.0 Yes
Application mcafee mcafee_framework 3.6.569 Yes
References