« Volver al listado

CVE-2008-1357

Estado: ModificadaMedia (5.4)—

Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Mcafee — AgentMcafee — CMAMcafee — Epolicy OrchestratorMcafee — Mcafee Framework

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-1357",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "HIGH",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-03-17T17:44:00.000",
  "references": [
    {
      "url": "http://aluigi.altervista.org/adv/meccaffi-adv.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/29337",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/3748",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/489476/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/28228",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1019609",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0866/references",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41178",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://knowledge.mcafee.com/article/234/615103_f.sal_public.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://aluigi.altervista.org/adv/meccaffi-adv.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/29337",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/3748",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/489476/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/28228",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1019609",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0866/references",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41178",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://knowledge.mcafee.com/article/234/615103_f.sal_public.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-134"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082.  NOTE: this issue only exists when the debug level is 8."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el formato de cadena en la función logDetail de applib.dlld en McAfee Common Management Agent (CMA) 3.6.0.574 (Parche 3) y anteriores, como se utiliza en ePolicy Orchestrator 4.0.0 build 1015, permite a atacantes remotos provocar una denegación de servicio (caída) o ejecutar código de su elección a través de formatos de especificadores de formatos de cadena en un fichero de envío en una solicitud AgentWakeup en el puerto 8082. NOTA: esta vulnerabilidad sólo sucede cuando se está en un nivel 8 de depuración."
    }
  ],
  "lastModified": "2026-06-16T22:51:33.740",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:agent:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43953695-9C35-4CC3-9591-D03866731F47"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:cma:3.0.6.453:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B7D230B-845A-4E83-B86C-000CDBAC937F"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:cma:3.5.5.438:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A0590CC-B03B-472B-A5FF-F6A316DBE2DC"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:cma:3.6.438:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0BD368FB-2683-4321-9491-CB757511AD49"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:cma:3.6.453:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F64F9F3F-F835-4769-9A5B-A05ED2AE7850"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:cma:3.6.546:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C0AE0A0-E56A-4B93-B45B-037C09EA69C3"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:cma:3.6.574:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFF00F5B-4272-49CC-A9CE-4CCD20F5DB3E"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "485DB16F-730A-44B2-A255-2583AB27DB9C"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:mcafee_framework:3.6.569:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6330056D-1DAF-4821-90E5-1E9E52594A25"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}