A vulnerability has been reported in McAfee Firewall Reporter, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error in the GernalUtilities.pm module when parsing the "cgisess" cookie value during the session validation process. This can be exploited to gain access to the web interface via directory traversal specifiers in the cookie's value, which points to a valid file on the system.

The vulnerability is reported in version 5.1.0.6.

Solution
Update to version 5.1.0.13.

Provided and/or discovered by
Andrea Micalizzi (rgod) via ZDI

Changelog
Further details available to Secunia VIM customers

Original Advisory
McAfee:
https://kc.mcafee.com/corporate/index?page=content&id=SB10015

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-117/

Deep Links
Links available to Secunia VIM customers