McAfee e-Business Server Authentication Packet Processing Denial Of Service - Advisories

Software Inspectors

	Scan Online

	Personal (PSI)

	Network (NSI 2.0)

Solutions For

	Security Professionals

	Security Vendors

Free Solutions For

	Open Communities

	Journalists & Media

Secunia Advisories

	Search

	Historic Advisories

	Listed By Product

	Listed By Vendor

	Statistics / Graphs

	Secunia Research

	Report Vulnerability

	About Advisories

Virus Information

	Chronological List

	Last 10 Virus Alerts

	About Virus Information

Secunia Customers

	Customer Area

McAfee e-Business Server Authentication Packet Processing Denial Of Service

Secunia Advisory:	SA24893
Release Date:	2007-04-18
Last Update:	2007-04-27

Critical:	Less critical
Impact:	DoS
Where:	From local network
Solution Status:	Vendor Patch

Software:	McAfee e-Business Server 8.x

CVE reference:	CVE-2007-2151 (Secunia mirror)

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Description: A vulnerability has been reported in McAfee e-Business Server, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error within the administration utility service when processing authentication packets. This can be exploited to crash the service via a specially crafted packet with an overly large length value. The vulnerability reportedly affects the following versions: * 8.5.1 and earlier for Windows * 8.5.1 and earlier for Solaris * 8.1.0 and earlier for Linux * 8.1.0 and earlier for HP-UX * 8.1.0 and earlier for AIX Solution: Apply updates. https://secure.nai.com/apps/downloads/my_products/login.asp 8.5.2 for Windows: EBus852-Windows-LICENSE.zip 8.5.2 for Solaris: EBus852-Solaris-LICENSE.tar.gz 8.1.1 for Linux: EBusSvr_8.1.1_Licensed_x86Linux.tar.gz 8.1.1 for HP-UX: EBusSrv_8.1.1_Licensed_HPUX.tar.gz 8.1.1 for AIX: EBusSvr_8.1.1_Licensed_AIX.tar.gz Provided and/or discovered by: Discovered by an anonymous person and reported via iDefense Labs. Changelog: 2007-04-27: Added CVE reference. Original Advisory: McAfee: https://knowledge.mcafee.com/SupportS...ommand=show&forward=nonthreadedKC iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=516



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

2 Related Secunia Security Advisories

1. McAfee E-Business Server Authentication Packet Handling Vulnerability

2. McAfee E-Business Server Authentication Packet Handling Buffer Overflow

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	dotProject SQL Injection and Cross-Site Scripting

2.	HP TCP/IP Services for OpenVMS Finger Format String Vulnerability

3.	Novell eDirectory Multiple Vulnerabilities

4.	Sun Solaris Kernel Covert Channel Security Bypass

5.	Adium MSN SLP Message Integer Overflow Vulnerabilities

6.	Blogn Cross-Site Scripting and Cross-Site Request Forgery

7.	Slackware update for amarok

8.	Caudium "configvar" Insecure Temporary Files

9.	Acoustica Mixcraft ".mx4" File Processing Buffer Overflow

10.	PluggedOut Blog "index.php" SQL Injection Vulnerabilities