'Specially crafted username' opens the keys to the kingdom of FAIL:
Designated CVE-2015-8024, the bug covers "McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) 9.3.x before 9.3.2MR19, 9.4.x before 9.4.2MR9, and 9.5.x before 9.5.0MR8, when configured to use Active Directory or LDAP authentication sources, allow remote attackers to bypass authentication by logging in with the username 'NGCP|NGCP|NGCP;' and any password", the advisory states.
So, you install a security product and that provides an open backdoor into your systems?
This discussion has been archived.
No new comments can be posted.
McAfee Security Manager lets Anybody Bypass Managers' Security
|
Log In/Create an Account
| Top
| 27 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(Score: 0) by Anonymous Coward on Wednesday December 09 2015, @01:37AM
Because I have more money than inklings about security.
(Score: -1, Redundant) by Anonymous Coward on Wednesday December 09 2015, @02:34AM
Or you work in the US Government. They love McAfee crap.
(Score: 2) by Fluffeh on Wednesday December 09 2015, @02:53AM
I think the OP comment still applies perfect to the US Government.
(Score: 5, Funny) by BK on Wednesday December 09 2015, @02:10AM
Seems like this would comply with French law…
...but you HAVE heard of me.
(Score: 3, Informative) by Fnord666 on Wednesday December 09 2015, @02:22AM
(Score: 2) by Fnord666 on Wednesday December 09 2015, @02:24AM
(Score: -1, Offtopic) by Anonymous Coward on Wednesday December 09 2015, @02:31AM
Trump just out-crazied you with the GOP crazies. You won't get any votes.
(Score: 0, Offtopic) by Runaway1956 on Wednesday December 09 2015, @02:35AM
Crazy is opening your borders to known enemies and unknown enemies. It's a proven fact that none of the western nations is competent at weeding out the bad actors. So, just throw the borders open, and let anyone through. THAT is crazy!
Abortion is the number one killed of children in the United States.
(Score: 0, Informative) by Anonymous Coward on Wednesday December 09 2015, @02:56AM
We let in your ancestors, didn't we? How much vetting was done in that case? Talk about crazy!
(Score: 2, Offtopic) by Runaway1956 on Wednesday December 09 2015, @03:31AM
WTF is "we", white boy? Let me reiterate - my ancestors came to this continent in several waves, some of them as early as 20,000 years ago, some as recently as 100 years ago. I'd like to know who you think "we" is.
Now, some of my ancestors allowed some of my other ancestors onto this continent. Some of my other ancestors resisted others of my ancestors coming here. The upshot is, some of my ancestors died as a result of others of my ancestors arrival here. For better or worse, that is water under the bridge - it's history. What I'm concerned about is the future. There is a new wave of invaders. I, for one, don't intend to become another statistic in the history of defeated people on this continent.
Islam does not have a history of playing nice with others. If you plan to have an overseer ensuring that you bow down and beat your head on the ground five times each day while facing Mecca, that's alright for you, I guess. I will not.
Abortion is the number one killed of children in the United States.
(Score: 0, Disagree) by Anonymous Coward on Wednesday December 09 2015, @03:52AM
It doesn't matter how *I* got my good seat. What matters is that we set up a PROCESS that doesn't let the riff-raff in!
It's hard to argue with a deep thinking philosopher.
(Score: 1, Troll) by aristarchus on Wednesday December 09 2015, @06:54AM
Seriously, who thinks Runaway actually knows with any accuracy who his ancestors are? I bet most of them are illegal ancestors. Like, you know, ancestors without documents, with only a deep and abiding desire to, well, you know, ancestorate. What better reason could there be for restricting Muslim immigration exclusively to Arkansaws? Or Arkansaw and Oklahoma? They already have the greatest numbers of, um, something. No, wait! Kansas! Leavenworth! Guantanamo! Racist bastards!
(Score: 2) by FatPhil on Wednesday December 09 2015, @09:40AM
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 2) by aristarchus on Thursday December 10 2015, @06:33AM
On the other hand, I find it is always a good idea to give precedence to native place names, and their native pronunciations. Oft I have heard that I am from "Saymous", or worse. Kansas and Arkansas are, of course, the names of the peoples who populated these places, before an unfortunate influx of illegal migrants.
(Score: 2) by FatPhil on Thursday December 10 2015, @08:14AM
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: -1, Offtopic) by Anonymous Coward on Wednesday December 09 2015, @03:35AM
Agreed. No one should let 'Muricans into their country.
(Score: 2) by aristarchus on Wednesday December 09 2015, @06:58AM
Reign of Fire! http://www.imdb.com/title/tt0253556/ [imdb.com] "Only thing worse than dragons: Americans" Line spoken by Gerald Butler, by the way, and given his more recent roles, completely in character. Because this is Sparta! Or Northern England! OR Donald Trump's Hair!!!
(Score: 0, Offtopic) by Anonymous Coward on Wednesday December 09 2015, @06:03AM
Runaway did your account get hacked or are you just upping the alcohol intake to prepare for the holidays? This shit seems a little less balanced than usual...
(Score: 3, Funny) by aristarchus on Wednesday December 09 2015, @07:02AM
With Runaway, I usually just check the phase of the moon. Rather reliable indicator. Not claiming causation, but correlation is good enough for prediction. And who would mod down this inquiry into the health of one of our fellow Soylentils! If we don't check up on each other, only the NSA will!
(Score: 3, Informative) by Runaway1956 on Wednesday December 09 2015, @02:57PM
I'm afraid that you haven't followed very carefully. Islam is an enemy of just about everybody who isn't Muslim. Islam has factions within it who positively hate everyone who isn't Muslim. It further has factions who positively hate everyone who isn't the correct flavor of Islam.
Look at the mideast. For as long as the mideast has been there, they have been plagued with violence. Things haven't gotten any better since Islam was established. It's the old status quo of kill everyone who isn't like you, with the addition of a hateful religion.
I've been saying as much for as long as I've been on the internet, which is much much longer that there has been a Soylentnews.
Please, show me a nation which has any significant Muslim population which is NOT routinely rocked by terrorist attacks, routine mass executions, slavery, arranged marriages of children,
You know, what really puzzles me about various people who stick up for Islam is, many of them are the very same people who bash Christianity. They don't understand that all the things they find wrong with Christianity is also wrong with Islam, but a couple orders of magnitude worse.
Abortion is the number one killed of children in the United States.
(Score: 0) by Anonymous Coward on Wednesday December 09 2015, @05:21PM
I'm afraid that you haven't followed very carefully. Islam is an enemy of just about everybody who isn't Muslim. Islam has factions within it who positively hate everyone who isn't Muslim. It further has factions who positively hate everyone who isn't the correct flavor of Islam.
So basically no different than the other Abrahamic religions. Cool story, brah.
(Score: 2) by Runaway1956 on Wednesday December 09 2015, @05:47PM
You're still not paying attention.
Judaism had a direct relationship with a God who was loving and abusive in turns.
Christianity had a direct relationship with the Son of God, who was loving and forgiving of sins.
Islam was founded by a murderous individual who usurped both of the earlier religions, and appropriated God to justify his violence. Unlike the other two religions, he commanded his followers to kill off the infidels, or to enslave them.
Have you ever read the Quran, or read a biography of Mohammed? If you have, you apparently learned little from it.
Abortion is the number one killed of children in the United States.
(Score: 2) by Username on Wednesday December 09 2015, @02:59AM
But how do they get around the Kerberos authentication itself?
(Score: 0) by Anonymous Coward on Wednesday December 09 2015, @05:50AM
"Hey trust me! Would I ever lie to you baby?!"
(Score: 3, Interesting) by mendax on Wednesday December 09 2015, @07:14AM
How much do you want to bet that the fix in this bug is not to close the backdoor but to change it?
It's really quite a simple choice: Life, Death, or Los Angeles.
(Score: 2) by wonkey_monkey on Wednesday December 09 2015, @08:43AM
So, you install a security product and that provides an open backdoor into your systems?
No?
systemd is Roko's Basilisk
(Score: 0) by Anonymous Coward on Wednesday December 09 2015, @02:50PM
...open keys. One uses keys to open doors. Kingdom of FAIL indeed. (Specifically the Duchy of Fucked Up Analogies)