CVE-2005-2187

Vulnerability

The McAfee IntruShield Security Management System (ISM) contains an authorization bypass vulnerability [1][2]. When the Access option is set to true, a remote authenticated user can access the 'Generate Reports' feature and modify alerts. The vulnerability is triggered by manipulating the fullAccess or fullAccessRight parameter in reports-column-center.jsp, or the fullAccess parameter in SystemEvent.jsp [1][2]. The affected software is identified as McAfee IntruShield Security Management System, versions prior to the June 2005 maintenance patch [3].

Exploitation

An attacker must have a valid authenticated session on the IntruShield Security Management System web console [1][2]. No additional privileges or write access are required beyond standard user authentication. The attacker simply crafts a request to the vulnerable JSP pages (reports-column-center.jsp or SystemEvent.jsp) and sets the fullAccess or fullAccessRight parameter to true [1][2]. This can be done remotely via a web browser or by sending a customized HTTP request.

Impact

Successful exploitation allows the authenticated attacker to bypass the intended access controls [1][2]. The attacker can generate reports and modify alerts, which are functions normally restricted to higher-privileged users. This represents a privilege escalation vulnerability that compromises the integrity and availability of security event management. The attacker could potentially alter or delete critical security alerts, undermining the monitoring capabilities of the IPS deployment.

Mitigation

A fix was scheduled for release in the June 2005 maintenance patch, as confirmed by McAfee [3]. Users should apply the vendor-supplied patch to correct the parameter validation and authorization logic. No workarounds were disclosed in the available references. If the product is no longer supported, users should upgrade to a supported version or implement network-level access controls to restrict access to the management console to trusted users only.