{"vuid":"VU#264092","idnumber":"264092","name":"McAfee ePolicy Orchestrator fails to properly validate SSL/TLS certificates","keywords":["McAfee","ePO","man-in-the-middle"],"overview":"McAfee ePolicy Orchestrator versions 4.6.8 and earlier and 5.1.1 and earlier fail to properly validate SSL/TLS certificates.","clean_desc":"CWE-295: Improper Certificate Validation - CVE-2015-2859 McAfee ePolicy Orchestrator (ePO) supports integration with external registered servers for a variety of purposes, such as data collection and aggregation. Optionally, ePO can be configured to use SSL/TLS to encrypt communications with registered servers. McAfee ePO fails to verify the signing certificate authority (CA) as well as the common name (CN) or domain name (DN) listed in a certificate. Consequently, these communication links are susceptible to man-in-the-middle interception and spoofing attacks. For more information, refer to McAfee's security bulletin SB10120.","impact":"An attacker can intercept and manipulate HTTPS traffic between the ePO application and registered servers.","resolution":"Apply an update McAfee has released versions 4.6.9 and 5.1.2 to address this and other issues. Users are encouraged to upgrade to the latest version available and should refer to the vendor's Knowledge Base KB84628 article specifying additional steps that are required to enforce certificate validation.","workarounds":"","sysaffected":"","thanks":"Thanks to the reporter who wishes to remain anonymous.","author":"This document was written by Joel Land.","public":["https://cwe.mitre.org/data/definitions/295.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10120","https://kc.mcafee.com/corporate/index?page=content&id=KB84628","https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/25000/PD25856/en_US/EPO_4_6_9_release_notes.pdf","https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/25000/PD25902/en_US/ePO512ReleaseNotes.pdf"],"cveids":["CVE-2015-2859"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2014-12-08T13:36:04Z","publicdate":"2015-06-04T00:00:00Z","datefirstpublished":"2015-06-04T17:25:04Z","dateupdated":"2015-06-05T20:08:25Z","revision":23,"vrda_d1_directreport":"1","vrda_d1_population":"4","vrda_d1_impact":"2","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"A","cvss_accesscomplexity":"M","cvss_authentication":null,"cvss_confidentialityimpact":"C","cvss_integrityimpact":"P","cvss_availabilityimpact":"N","cvss_exploitablity":null,"cvss_remediationlevel":"OF","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"N","cvss_targetdistribution":"H","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"6.4","cvss_basevector":"AV:A/AC:M/Au:N/C:C/I:P/A:N","cvss_temporalscore":"5","cvss_environmentalscore":"4.99603433759136","cvss_environmentalvector":"CDP:N/TD:H/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}