Test ID:	1.3.6.1.4.1.25623.1.0.10425
Category:	Gain a shell remotely
Title:	NAI Management Agent overflow
Summary:	NOSUMMARY
Description:	Description: The remote NAI WebShield SMTP Management tool is vulnerable to a buffer overflow which allows an attacker to gain execute arbitrary code on this host when it is issued a too long argument as a configuration parameter. In addition to this, it allows an attacker to disable the service at will. * To re-enable the service : - execute regedit - edit the registry key 'Quarantine_Path' under HKLM\SOFTWARE\Network Associates\TVD\WebShield SMTP\MailScan - change its value from 'XXX...XXX' to the valid path to the quarantine folder. - restart the service Solution : filter incoming traffic to this port. You may also restrict the set of trusted hosts in the configuration console : - go to the 'server' section - select the 'trusted clients' tab - and set the data accordingly Risk factor : High
Cross-Ref:	BugTraq ID: 1254 Common Vulnerability Exposure (CVE) ID: CVE-2000-0447 http://www.securityfocus.com/bid/1254 Bugtraq: 20000525 DST2K0003 : Buffer Overrun in NAI WebShield SMTP v4.5.44 Managem ent Tool (Google Search) http://www.securityfocus.com/templates/archive.pike?list=1&msg=6C740781F92BD411831F0090273A8AB806FD4A@exchange.servers.delphis.net http://www.osvdb.org/327 XForce ISS Database: nai-webshield-bo
Copyright	This script is Copyright (C) 2000 Renaud Deraison

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.