CVE-2009-5115

McAfee Common Management Agent (CMA) 3.5.5 through 3.5.5.588 and 3.6.0 through 3.6.0.608, and McAfee Agent 4.0 before Patch 3, allows remote authenticated users to overwrite arbitrary files by accessing a report-writing ActiveX control COM object.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/78446
https://kc.mcafee.com/corporate/index?page=content&id=SB10002	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mcafee:common_management_agent:3.5.5.438:::::::*
	cpe:2.3:a:mcafee:common_management_agent:3.5.5.568:::::::*
	cpe:2.3:a:mcafee:common_management_agent:3.5.5.577:::::::*
	cpe:2.3:a:mcafee:common_management_agent:3.5.5.580:::::::*
	cpe:2.3:a:mcafee:common_management_agent:3.5.5.588:::::::*
	cpe:2.3:a:mcafee:common_management_agent:3.6.0.438:::::::*
	cpe:2.3:a:mcafee:common_management_agent:3.6.0.453:::::::*
	cpe:2.3:a:mcafee:common_management_agent:3.6.0.546:::::::*
	cpe:2.3:a:mcafee:common_management_agent:3.6.0.569:::::::*
	cpe:2.3:a:mcafee:common_management_agent:3.6.0.574:::::::*
	cpe:2.3:a:mcafee:common_management_agent:3.6.0.595:::::::*
	cpe:2.3:a:mcafee:common_management_agent:3.6.0.603:::::::*

History

No history.

Information

Published : 2012-08-22 10:42

Updated : 2023-12-10 11:16

NVD link : CVE-2009-5115

Mitre link : CVE-2009-5115

CVE.ORG link : CVE-2009-5115

JSON object : View

Products Affected

mcafee

common_management_agent

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2009-5115", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-08-22T10:42:03.523", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78446", "source": "cve@mitre.org"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10002", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "McAfee Common Management Agent (CMA) 3.5.5 through 3.5.5.588 and 3.6.0 through 3.6.0.608, and McAfee Agent 4.0 before Patch 3, allows remote authenticated users to overwrite arbitrary files by accessing a report-writing ActiveX control COM object."}, {"lang": "es", "value": "McAfee Common Management Agent (CMA) v3.5.5 hasta v3.5.5.588 y v3.6.0 hasta v3.6.0.608, y McAfee Agent v4.0 anteriores a Patch 3, permite a usuarios remotos autentificados a sobreescribir ficheros accediendo al objeto COM que es un control ActiveX (report-writing )."}], "lastModified": "2017-08-29T01:29:03.033", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:common_management_agent:3.5.5.438:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2A376DB-CC55-434C-AD61-8DF2B5DE7647"}, {"criteria": "cpe:2.3:a:mcafee:common_management_agent:3.5.5.568:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE95EBCC-6268-4605-98D2-92EFFCA38DAC"}, {"criteria": "cpe:2.3:a:mcafee:common_management_agent:3.5.5.577:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0885BB5-7030-498E-B48D-CC14F8741AEF"}, {"criteria": "cpe:2.3:a:mcafee:common_management_agent:3.5.5.580:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "341EA9D7-C82F-41AC-88BA-69273226E17B"}, {"criteria": "cpe:2.3:a:mcafee:common_management_agent:3.5.5.588:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDA5C527-5770-4B91-A2A5-0C96CE4C91B5"}, {"criteria": "cpe:2.3:a:mcafee:common_management_agent:3.6.0.438:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5A9ECA8-BE32-4A05-9E65-3C8F8A34227D"}, {"criteria": "cpe:2.3:a:mcafee:common_management_agent:3.6.0.453:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "857A25D8-06F5-4B3A-A6FA-71B3472961A7"}, {"criteria": "cpe:2.3:a:mcafee:common_management_agent:3.6.0.546:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33587225-BE54-45A1-97FD-2274673F9AE3"}, {"criteria": "cpe:2.3:a:mcafee:common_management_agent:3.6.0.569:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3D30ADB-7A7C-413D-8D87-5AAF7399C43B"}, {"criteria": "cpe:2.3:a:mcafee:common_management_agent:3.6.0.574:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61BB94AF-676E-465B-AEFB-019EEFA3EACF"}, {"criteria": "cpe:2.3:a:mcafee:common_management_agent:3.6.0.595:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B57AB6D-0C75-4191-B375-4EA832352BC5"}, {"criteria": "cpe:2.3:a:mcafee:common_management_agent:3.6.0.603:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CFAE871-654E-46AE-BD15-04790F97E0B2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}