Multiple vulnerabilities have been reported in McAfee Email and Web Security Appliance and Email Gateway, which can be exploited by malicious users to disclose certain sensitive information and by malicious people to bypass certain security restrictions and conduct cross-site scripting attacks.

1) An unspecified error within the authentication mechanism can be exploited to gain administrative privileges.

2) Certain input passed to the web interface is not properly verified before being used to download files. This can be exploited to download arbitrary files from local resources via directory traversal sequences.

NOTE: This vulnerability only affects McAfee Email Gateway 7.x.

3) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in the following products:
* McAfee Email Gateway (MEG) versions 7.0.0 and 7.0.1.
* McAfee Email and Web Security (EWS) versions 5.6 Patch 3 and prior
* McAfee Email and Web Security (EWS) versions 5.5 Patch 6 and prior

Solution
Apply patches if available (please see the vendor's advisory for more information).

Provided and/or discovered by
The vendor credits Tenable Network Security.

Original Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10026

Deep Links
Links available to Secunia VIM customers