CVE Feed

    Dashboard / CVE / CVE-2008-1357

    CVE-2008-1357

    Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8.

    Published:Mar 17, 2008
    Last Modified:Apr 23, 2026
    EPS:Mar 17, 2008
    EPSS Score:0.27884
    CVSS Score:5.4

    Affected Products

    Vendor
    Mcafee
    Product
    Agent
    Vendor
    Mcafee
    Product
    Cma
    Vendor
    Mcafee
    Product
    Epolicy Orchestrator
    Vendor
    Mcafee
    Product
    Mcafee Framework

    Exploits

    http://aluigi.altervista.org/adv/meccaffi-adv.txthttp://www.securityfocus.com/bid/28228http://aluigi.altervista.org/adv/meccaffi-adv.txthttp://www.securityfocus.com/bid/28228https://www.exploit-db.com/exploits/31399

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-135 Format String Injection
    CAPEC-67 String Format Overflow in syslog()

    Related CVEs

    CVE-2022-2313 (CVSS 8.2) — A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users t…
    CVE-2022-1257 (CVSS 6.1) — Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 all…
    CVE-2022-1258 (CVSS 8.4) — A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be ex…
    CVE-2022-1256 (CVSS 7.8) — A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user…
    CVE-2022-0166 (CVSS 7.8) — A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during …
    CVE-2021-31854 (CVSS 7.7) — A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject…
    CVE-2021-31847 (CVSS 8.2) — Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could …
    CVE-2021-31839 (CVSS 4.8) — Improper privilege management vulnerability in McAfee Agent for Windows prior to 5.7.3 allows a local user to …
    CVE-2021-1257 (CVSS 8.8) — A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthentica…
    CVE-2020-7343 (CVSS 5.5) — Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to bloc…

    References

    http://aluigi.altervista.org/adv/meccaffi-adv.txt
    http://secunia.com/advisories/29337
    http://securityreason.com/securityalert/3748
    http://www.securityfocus.com/archive/1/489476/100/0/threaded
    http://www.securityfocus.com/bid/28228
    http://www.securitytracker.com/id?1019609
    http://www.vupen.com/english/advisories/2008/0866/references
    https://exchange.xforce.ibmcloud.com/vulnerabilities/41178
    https://knowledge.mcafee.com/article/234/615103_f.sal_public.html
    http://aluigi.altervista.org/adv/meccaffi-adv.txt
    http://secunia.com/advisories/29337
    http://securityreason.com/securityalert/3748
    http://www.securityfocus.com/archive/1/489476/100/0/threaded
    http://www.securityfocus.com/bid/28228
    http://www.securitytracker.com/id?1019609
    http://www.vupen.com/english/advisories/2008/0866/references
    https://exchange.xforce.ibmcloud.com/vulnerabilities/41178
    https://knowledge.mcafee.com/article/234/615103_f.sal_public.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High