Secunia

Neel Mehta has reported some vulnerabilities in McAfee ePolicy Orchestrator and ProtectionPilot, which can be exploited by malicious people to compromise a vulnerable system.

1) An integer underflow error can be exploited to cause a memory corruption and execute arbitrary code.

2) A boundary error within the processing of pings can be exploited to cause a stack-based buffer overflow via a specially crafted packet.

Successful exploitation of this vulnerability allows execution of arbitrary code.

3) A boundary error can be exploited to cause a heap-based buffer overflow via a specially crafted packet.

Successful exploitation of this vulnerability allows execution of arbitrary code.

4) An integer overflow error can be exploited to cause a buffer overflow and execute arbitrary code.

Solution
Apply patches. Please see the vendor's advisories for details.

Provided and/or discovered by
Neel Mehta, IBM ISS X-Force.

Changelog
Further details available in Customer Area

Original Advisory
IBM ISS X-Force:
http://www.iss.net/threats/269.html

McAfee:
https://knowledge.mcafee.com/article/761/613364_f.SAL_Public.html
https://knowledge.mcafee.com/article/762/613365_f.SAL_Public.html
https://knowledge.mcafee.com/article/763/613366_f.SAL_Public.html
https://knowledge.mcafee.com/article/764/613367_f.SAL_Public.html

Deep Links
Links available in Customer Area