CVE-2017-3968 : Security Advisory and Response

A security vulnerability has been discovered in the web interface of McAfee Network Security Manager (NSM) versions prior to 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) versions prior to 9.3.4.1.5. This vulnerability, known as session fixation, enables attackers to access sensitive information or alter the database by using a specially crafted authentication cookie.

Understanding CVE-2017-3968

This CVE involves a session fixation vulnerability in McAfee NSM and NDLP, allowing remote attackers to disclose sensitive information or manipulate the database.

What is CVE-2017-3968?

CVE-2017-3968 is a security vulnerability affecting McAfee Network Security Manager (NSM) and Network Data Loss Prevention (NDLP) versions prior to specific versions, enabling attackers to exploit session fixation.

The Impact of CVE-2017-3968

The vulnerability has a CVSS base score of 7.5, with high severity due to its potential for disclosing sensitive information and database manipulation.

Technical Details of CVE-2017-3968

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability allows remote attackers to exploit session fixation in the web interface of McAfee NSM and NDLP, potentially leading to unauthorized access and data manipulation.

Affected Systems and Versions

McAfee Network Security Manager (NSM): Versions prior to 8.2.7.42.2
McAfee Network Data Loss Prevention (NDLP): Versions prior to 9.3.4.1.5 Hotfix 1201697_47868

Exploitation Mechanism

Attackers can exploit this vulnerability by using a specially crafted authentication cookie to gain unauthorized access or manipulate the database.

Mitigation and Prevention

Protecting systems from CVE-2017-3968 requires immediate actions and long-term security practices.

Immediate Steps to Take

Apply security patches provided by McAfee promptly to mitigate the vulnerability.
Monitor network traffic for any suspicious activities that could indicate exploitation attempts.

Long-Term Security Practices

Regularly update and patch McAfee NSM and NDLP to address security vulnerabilities.
Implement strong authentication mechanisms to prevent session fixation attacks.

Patching and Updates

Ensure that McAfee NSM is updated to version 8.2.7.42.2 or later.
Update McAfee NDLP to version 9.3.4.1.5 Hotfix 1201697_47868 or higher.