Re: ZDI-11-117: McAfee Firewall Reporter GeneralUtilities.pm isValidClient Authentication Bypass Vulnerability

[nospam@xxxxxxxx]

McAfee stated:

[quote]
 Impact of Vulnerability:
Disabling Anti-Virus, adding unwanted exclusions
[/quote]

When submitting this bug to ZDI, I made availiable two reliable post-bypass 
proof-of-concepts: 
- a static perl code injection exploit using the 'args' argument of 
saveTopImagelogos.cgi
- an upload and execute exploit using uploadFile.cgi

In both cases, the result was remote command execution with SYSTEM privileges. 
This was tested against the default Apache installation.
ZDI did not acquire post-auth vulnerabilities, so I was considering to disclose 
them after the patch was out but, in the end, not.

I'm saying this to allow people to classify this vulnerability with the correct 
metrics.

rgod