McAfee Network Data Loss Prevention Vulnerabilities

Multiple vulnerabilities were identified in McAfee Network Data Loss Prevention (DLP). A remote user can cause denial of service conditions, inject SQL commands and conduct click-jacking attacks.

1. A remote user can send a specially crafted RAR file to trigger a segmentation fault and make the target system unusable for a period of time.
2. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database.
3. The system does not provide proper framing protection (X-Frame header). A remote user can conduct click-jacking or frame-sniffing attacks to take actions on the target system acting as the target user.