====================================================================

                           CERT-Renater

               Note d'Information No. 2015/VULN110
_____________________________________________________________________

DATE                : 16/06/2015

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running McAfee ePolicy Orchestrator
                       version prior to 4.6.9, 5.1.2.

======================================================================
https://www.kb.cert.org/vuls/id/264092
______________________________________________________________________


Vulnerability Note VU#264092

McAfee ePolicy Orchestrator fails to properly validate SSL/TLS certificates

Original Release date: 04 juin 2015 | Last revised: 05 juin 2015


Overview

McAfee ePolicy Orchestrator versions 4.6.8 and earlier and 5.1.1 and
earlier fail to properly validate SSL/TLS certificates.


Description

CWE-295: Improper Certificate Validation - CVE-2015-2859

McAfee ePolicy Orchestrator (ePO) supports integration with external
registered servers for a variety of purposes, such as data collection
and aggregation. Optionally, ePO can be configured to use SSL/TLS to
encrypt communications with registered servers. McAfee ePO fails to
verify the signing certificate authority (CA) as well as the common
name (CN) or domain name (DN) listed in a certificate. Consequently,
these communication links are susceptible to man-in-the-middle
interception and spoofing attacks.

For more information, refer to McAfee's security bulletin SB10120.


Impact

An attacker can intercept and manipulate HTTPS traffic between the ePO
application and registered servers.


Solution

Apply an update

McAfee has released versions 4.6.9 and 5.1.2 to address this and other
issues. Users are encouraged to upgrade to the latest version available
and should refer to the vendor's Knowledge Base KB84628 article
specifying additional steps that are required to enforce certificate
validation.


Vendor Information

Vendor	Status	Date Notified	Date Updated
McAfee	Affected	22 Dec 2014	05 Jun 2015

If you are a vendor and your product is affected, let us know.

CVSS Metrics

Group 	Score 	Vector
Base 	6,4 	AV:A/AC:M/Au:N/C:C/I:P/A:N
Temporal 	5,0 	E:POC/RL:OF/RC:C
Environmental 	5,0 	CDP:N/TD:H/CR:ND/IR:ND/AR:ND


References

    https://cwe.mitre.org/data/definitions/295.html
    https://kc.mcafee.com/corporate/index?page=content&id=SB10120
    https://kc.mcafee.com/corporate/index?page=content&id=KB84628

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/25000/PD25856/en_US/EPO_4_6_9_release_notes.pdf

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/25000/PD25902/en_US/ePO512ReleaseNotes.pdf


Credit

Thanks to the reporter who wishes to remain anonymous.

This document was written by Joel Land.


Other Information

    CVE IDs: CVE-2015-2859
    Date Public: 04 juin 2015
    Date First Published: 04 juin 2015
    Date Last Updated: 05 juin 2015
    Document Revision: 22

Feedback

If you have feedback, comments, or additional information about this
vulnerability, please send us email.


=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================