cnvd - cnvd-2016-12625

cnvd-2016-12625

Vulnerability from cnvd

Title: McAfee VirusScan Enterprise CRLF注入漏洞

Description:

McAfee VirusScan Enterprise是美国迈克菲（McAfee）公司的一套杀毒软件。该软件提供全方位的安全防护、扫描内存以查找恶意代码和为远程系统优化更新等功能。

VirusScan Enterprise for Linux (VSEL) 2.0.3及其之前版本存在CRLF注入漏洞。允许未经身份验证的远程攻击者通过欺骗服务器的HTTP响应获取敏感信息。

Severity: 高

Patch Name: McAfee VirusScan Enterprise CRLF注入漏洞的补丁

Patch Description:

VirusScan Enterprise for Linux (VSEL) 2.0.3及其之前版本存在CRLF注入漏洞。允许未经身份验证的远程攻击者通过欺骗服务器的HTTP响应获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： http://www.kb.cert.org/vuls/id/245327

Reference: http://www.securityfocus.com/bid/94823 https://kc.mcafee.com/corporate/index?page=content&id=SB10181

Impacted products

Name
McAfee VirusScan Enterprise for Linux (VSEL) <=2.0.3

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94823"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-8024"
    }
  },
  "description": "McAfee VirusScan Enterprise\u662f\u7f8e\u56fd\u8fc8\u514b\u83f2\uff08McAfee\uff09\u516c\u53f8\u7684\u4e00\u5957\u6740\u6bd2\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u63d0\u4f9b\u5168\u65b9\u4f4d\u7684\u5b89\u5168\u9632\u62a4\u3001\u626b\u63cf\u5185\u5b58\u4ee5\u67e5\u627e\u6076\u610f\u4ee3\u7801\u548c\u4e3a\u8fdc\u7a0b\u7cfb\u7edf\u4f18\u5316\u66f4\u65b0\u7b49\u529f\u80fd\u3002\r\n\r\nVirusScan Enterprise for Linux (VSEL) 2.0.3\u53ca\u5176\u4e4b\u524d\u7248\u672c\u5b58\u5728CRLF\u6ce8\u5165\u6f0f\u6d1e\u3002\u5141\u8bb8\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u901a\u8fc7\u6b3a\u9a97\u670d\u52a1\u5668\u7684HTTP\u54cd\u5e94\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "Andrew Fasano and Shelby Kaba.",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttp://www.kb.cert.org/vuls/id/245327",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-12625",
  "openTime": "2016-12-20",
  "patchDescription": "McAfee VirusScan Enterprise\u662f\u7f8e\u56fd\u8fc8\u514b\u83f2\uff08McAfee\uff09\u516c\u53f8\u7684\u4e00\u5957\u6740\u6bd2\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u63d0\u4f9b\u5168\u65b9\u4f4d\u7684\u5b89\u5168\u9632\u62a4\u3001\u626b\u63cf\u5185\u5b58\u4ee5\u67e5\u627e\u6076\u610f\u4ee3\u7801\u548c\u4e3a\u8fdc\u7a0b\u7cfb\u7edf\u4f18\u5316\u66f4\u65b0\u7b49\u529f\u80fd\u3002\r\n\r\nVirusScan Enterprise for Linux (VSEL) 2.0.3\u53ca\u5176\u4e4b\u524d\u7248\u672c\u5b58\u5728CRLF\u6ce8\u5165\u6f0f\u6d1e\u3002\u5141\u8bb8\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u901a\u8fc7\u6b3a\u9a97\u670d\u52a1\u5668\u7684HTTP\u54cd\u5e94\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "McAfee VirusScan Enterprise CRLF\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "McAfee VirusScan Enterprise for Linux (VSEL) \u003c=2.0.3"
  },
  "referenceLink": "http://www.securityfocus.com/bid/94823\r\nhttps://kc.mcafee.com/corporate/index?page=content\u0026id=SB10181",
  "serverity": "\u9ad8",
  "submitTime": "2016-12-14",
  "title": "McAfee VirusScan Enterprise CRLF\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2016-8024 (GCVE-0-2016-8024)

Vulnerability from cvelistv5

Published

2017-03-14 22:00

Modified

2024-08-06 02:13

Severity ?

CWE

Improper neutralization of CRLF sequences in HTTP headers vulnerability

Summary

Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/94823	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1037433	vdb-entry, x_refsource_SECTRACK
	https://kc.mcafee.com/corporate/index?page=content&id=SB10181	x_refsource_CONFIRM
	https://www.exploit-db.com/exploits/40911/	exploit, x_refsource_EXPLOIT-DB

Impacted products

	Vendor	Product	Version
	Intel	VirusScan Enterprise Linux (VSEL)	Version: 2.0.3 (and earlier)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:13:21.584Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "94823",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94823"
          },
          {
            "name": "1037433",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037433"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10181"
          },
          {
            "name": "40911",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/40911/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "VirusScan Enterprise Linux (VSEL)",
          "vendor": "Intel",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.3 (and earlier)"
            }
          ]
        }
      ],
      "datePublic": "2016-12-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper neutralization of CRLF sequences in HTTP headers vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-02T09:57:01",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "name": "94823",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94823"
        },
        {
          "name": "1037433",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037433"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10181"
        },
        {
          "name": "40911",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/40911/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2016-8024",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "VirusScan Enterprise Linux (VSEL)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2.0.3 (and earlier)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Intel"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper neutralization of CRLF sequences in HTTP headers vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "94823",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94823"
            },
            {
              "name": "1037433",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037433"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10181",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10181"
            },
            {
              "name": "40911",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/40911/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2016-8024",
    "datePublished": "2017-03-14T22:00:00",
    "dateReserved": "2016-09-09T00:00:00",
    "dateUpdated": "2024-08-06T02:13:21.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted