mailing list archives
EEYE: McAfee ePolicy Orchestrator Remote Compromise
From: "eEye Advisories" <Advisories () eeye com>
Date: Fri, 14 Jul 2006 10:30:31 -0700
McAfee ePolicy Orchestrator Remote Compromise
July 13, 2006
High (Remote Code Execution)
McAfee Common Management (EPO) Agent versions below version 126.96.36.1998
McAfee ePolicy Orchestrator is the remote security management software
for the McAfee enterprise product suite. EPO allows you to configure and
enforce protection policies, deploy and configure agents, and monitor
security status from a centralized console.
eEye Digital Security has discovered a serious flaw within the Framework
Service component of the McAfee EPO management console. The Framework
service is enabled and running by default on all servers and agents. The
framework service listens by default on port 8081 and accepts requests
over the HTTP protocol. The framework service allows for remotely
submitting configuration and update changes. Each request is encrypted,
SHA-1 hashed and DSA signed, and written to a file on disk. Due to a
directory traversal attack, it is possible to write any file with any
contents to anywhere on the remote system.
This flaw allows a remote attacker to anonymously compromise an affected
system and execute code within the SYSTEM context.
This vulnerability was discovered by McAfee and eEye Digital Security,
individually of each other. McAfee had silently fixed this
vulnerability, prior to the discovery by eEye. It is good for any
software company to be proactive in trying to secure their software.
However, it is equally important for software vendors to create a
separation of security and features when providing updates. In this
case, fixing an extremely critical vulnerability without the proper
notification is a disservice to customers. The mindset of most
customers, especially when dealing with agent software, is to use what
works. This creates a scenario where organizations would potentially
choose to stick with their current deployments, rather than re-deploying
hundreds, if not thousands, of new agents for what would appear to
solely contain innocuous feature updates. We hope organizations take
note and verify they do indeed have the latest ePO framework installed,
and if not, update as soon as possible. -Marc Maiffret
The framework service accepts POST requests over the /spipe/pkg
interface. These POST requests contain a header which indicates the type
of package request, UUID, and computer hostname. Depending on the
request, the block that follows may contain data specific to that
request. In the case of this vulnerability, the type of request
(PackageType) is "PropsResponse". The data that follows first specifies
a directory and xml filename, and is followed by the contents of the xml
file. Due to improper sanity checking on the directory and filename, it
is possible to use a directory traversal attack to write a user defined
filename, with user defined contents, anywhere on the system.
A factor that would hinder exploitation is the fact that the file is
immediately deleted after use - this problem can be overcome by
increasing the file data length field to exceed the actual data length.
Each package request is obfuscated by XOR'ing the package data with the
static byte 0xAA, and is then SHA-1 hashed and DSA signed.
The vulnerable package format follows:
+00h WORD magic = "PO" (0x4F50)
+02h DWORD = 20000001h, 20001001h, or 30000001
+06h DWORD file offset of XML
+0Ah [E0h] fixed-length data
+12h DWORD length of XML
+16h [40h] ASCII ??? GUID
+56h [40h] ASCII ??? GUID
+9Ah [???] ASCII host name
+EAh [...] name-value pairs
X+00h DWORD length of following name string
+04h [...] ASCII name string (no null terminator)
X+00h DWORD length of following value data
+04h [...] value data (null terminated if ASCII string)
X+00h [...] XML
+02h WORD length of following file name string
+04h [...] ASCII .xml file name string * traversal attack, may be any
directory and file extension
X+00h DWORD length of following XML * increase length to prevent
+04h [...] ASCII XML * filename data
X+00h DWORD length of signature data = 2Ch
+04h WORD (big-endian) number of bits in DSA signature 'r' component
+06h [14h] DSA signature 'r' component (technically it's
+1Ah WORD (big-endian) number of bits in DSA signature 's' component
+1Ch [14h] DSA signature 's' component (also variable-length)
The package may be modified to generate any file, anywhere on the
system, with any extension.
Exploitation is 100% reliable due to the fact we are merely taking
advantage of functions already implemented within the framework service.
Retina - Network Security Scanner - has been updated to identify this
Blink - Endpoint Vulnerability Prevention - preemptively protects from
McAfee customers must login to the McAfee customer website and download
version 188.8.131.528 or higher of the Common Management Agent (ePO
Framework) and upgrade existing ePO agent deployments.
For more information, McAfee has published a knowledgebase article,
which can be found here.
Additional Research: Derek Soeder
Retina Network Security Scanner - Free Trial
Blink Endpoint Vulnerability Prevention - Free Trial
Derek (props!), D R E, Carlos, the Samyo's, MereMac, Big Smooth and the
rest of the boys from R-Block.
Copyright (c) 1998-2006 eEye Digital Security
Permission is hereby granted for the redistribution of this alert
electronically. It is not to be edited in any way without express
consent of eEye. If you wish to reprint the whole or any part of this
alert in any other medium excluding electronic medium, please email
alert () eEye com for permission.
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are no warranties, implied or express, with regard to this information.
In no event shall the author be liable for any direct or indirect
damages whatsoever arising out of or in connection with the use or
spread of this information. Any use of this information is at the user's
- EEYE: McAfee ePolicy Orchestrator Remote Compromise eEye Advisories (Jul 14)