search menu icon-carat-right cmu-wordmark

CERT Coordination Center

McAfee ePolicy Orchestrator fails to properly validate SSL/TLS certificates

Vulnerability Note VU#264092

Original Release Date: 2015-06-04 | Last Revised: 2015-06-05

Overview

McAfee ePolicy Orchestrator versions 4.6.8 and earlier and 5.1.1 and earlier fail to properly validate SSL/TLS certificates.

Description

CWE-295: Improper Certificate Validation - CVE-2015-2859

McAfee ePolicy Orchestrator (ePO) supports integration with external registered servers for a variety of purposes, such as data collection and aggregation. Optionally, ePO can be configured to use SSL/TLS to encrypt communications with registered servers. McAfee ePO fails to verify the signing certificate authority (CA) as well as the common name (CN) or domain name (DN) listed in a certificate. Consequently, these communication links are susceptible to man-in-the-middle interception and spoofing attacks.

For more information, refer to McAfee's security bulletin SB10120.

Impact

An attacker can intercept and manipulate HTTPS traffic between the ePO application and registered servers.

Solution

Apply an update

McAfee has released versions 4.6.9 and 5.1.2 to address this and other issues. Users are encouraged to upgrade to the latest version available and should refer to the vendor's Knowledge Base KB84628 article specifying additional steps that are required to enforce certificate validation.

Vendor Information

264092
 
Affected   Unknown   Unaffected

McAfee

Notified:  December 22, 2014 Updated:  June 05, 2015

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Addendum

McAfee ePolicy Orchestration versions 4.6.8 and earlier and 5.1.1 and earlier are affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base 6.4 AV:A/AC:M/Au:N/C:C/I:P/A:N
Temporal 5.0 E:POC/RL:OF/RC:C
Environmental 5 CDP:N/TD:H/CR:ND/IR:ND/AR:ND

References

Acknowledgements

Thanks to the reporter who wishes to remain anonymous.

This document was written by Joel Land.

Other Information

CVE IDs: CVE-2015-2859
Date Public: 2015-06-04
Date First Published: 2015-06-04
Date Last Updated: 2015-06-05 20:08 UTC
Document Revision: 22

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.