McAfee Data Loss Prevention 9.1/9.2/9.3 MySQL Statement sql injection

Summaryinfo

A vulnerability classified as problematic has been found in McAfee Data Loss Prevention 9.1/9.2/9.3. This affects an unknown part of the component MySQL Statement Handler. This manipulation causes sql injection. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in McAfee Data Loss Prevention 9.1/9.2/9.3 (Data Loss Prevention Software). Affected by this vulnerability is some unknown processing of the component MySQL Statement Handler. The manipulation with an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was released 05/28/2014 as SB10074 / 921267 as confirmed advisory (Website). It is possible to read the advisory at kc.mcafee.com. The exploitation appears to be difficult. Attacking locally is a requirement. Required for exploitation is a single authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK. The advisory points out:

Providing specific data to an application in areas where data is used directly in an SQL query can cause the SQL server to execute data passed to it directly as code. This can often allow an attacker complete access to the SQL database used by the application. An attacker can view and manipulate the database affecting the confidentiality and integrity of the application.

The advisory illustrates:

The attack is highly unlikely because the application is available to the internal company network only. Furthermore, application user credentials that have the privileges to view the Incident report are required.

Upgrading to version 9.3.2 eliminates this vulnerability. The upgrade is hosted for download at mcafee.com. Applying the patch 963587_47041 is able to eliminate this problem. The bugfix is ready for download at mcafee.com. The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published immediately after the disclosure of the vulnerability. The advisory contains the following remark:

This is fixed by sanitising URI query before database access.

The vulnerability is also documented in the vulnerability database at Secunia (SA58886†). Additional details are provided at kc.mcafee.com. Entries connected to this vulnerability are available at VDB-13412 and VDB-13410. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Data Loss Prevention Software

Vendor

• McAfee

Name

• Data Loss Prevention

Version

• 9.1
• 9.2
• 9.3

License

• commercial

Website

• Vendor: https://www.mcafee.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion