|
CA iGateway debug mode HTTP GET request buffer overflow
|
|
|
|
|
Secunia Advisory:
|
SA17085
|
|
|
Udsendt:
|
2005-10-11
|
|
Sidste Opdt.:
|
2005-10-19
|
|
|
Kritisk:
|
Moderat kritisk
|
|
Betydning:
|
Systemadgang
|
|
Hvor:
|
Fra Internet
|
|
Løsning Status:
|
Producent Patch
|
|
| Software: | BrightStor ARCserve Backup 11.x
BrightStor ARCserve Backup 11.x (for Windows)
BrightStor ARCserve Backup 9.x
BrightStor Enterprise Backup 10.x
BrightStor Process Automation Manager 11.x
BrightStor Storage Resource Manager 11.x
BrightStor Storage Resource Manager 6.x
CA Advantage Data Transformer 2.x
CA AllFusion Harvest Change Manager 7.x
CA ARCserve Backup for Laptops & Desktops 11.x
CA BrightStor Portal 11.x
CA BrightStor SAN Manager 11.x
CA eTrust Admin 8.x
CA eTrust Audit 1.x
CA eTrust Audit 8.x
CA eTrust Identity Minder 8.x
CA Unicenter Service Fulfillment 2.x
eTrust Secure Content Manager (SCM)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Beskrivelse:
Erika Mendoza har rapporteret en sårbarhed i CA iGateway, som kan udnyttes af ondsindede personer til at kompromittere et sårbart system.
Sårbarheden skyldes en ikke-kontrolleret buffer ved tolkning af HTTP GET forespørgsler. Dette kan udnyttes til at forårsage et buffer overflow og gør det muligt at eksekvere vilkårlig kode.
Succesfuld udnyttelse kræver at debug mode er aktiveret.
Sårbarheden er rapporteret i iGateway versioner tidligere end 4.0.050615, som er inkluderet i følgende produkter:
* Advantage Data Transformer (ADT) R2.2
* Harvest Change Manager R7.1
* BrightStor ARCserve Backup r11.5
* BrightStor ARCserve Backup r11.1
* BrightStor ARCserve Backup for Windows r11
* BrightStor Enterprise Backup 10.5
* BrightStor ARCserve Backup v9.01
* BrightStor ARCserve Backup Laptop & Desktop r11.1
* BrightStor ARCserve Backup Laptop & Desktop r11
* BrightStor Process Automation Manager r11.1
* BrightStor SAN Manager r11.1
* BrightStor SAN Manager r11.5
* BrightStor Storage Resource Manager r11.5
* BrightStor Storage Resource Manager r11.1
* BrightStor Storage Resource Manager 6.4
* BrightStor Storage Resource Manager 6.3
* BrightStor Portal 11.1
* eTrust Audit 1.5 SP2 (iRecorders and ARIES)
* eTrust Audit 1.5 SP3 (iRecorders and ARIES)
* eTrust Audit 8.0 (iRecorders and ARIES)
* eTrust Admin 8.0
* eTrust Admin 8.1
* eTrust Identity Minder 8.0
* eTrust Secure Content Manager (SCM) R8
* eTrust Web Service Security R8
* eTrust Integrated Threat Management (ITM) R8
* Unicenter CA Web Services Distributed Management R11
* Unicenter AutoSys JM R11
* Unicenter Management for WebLogic / Management for WebSphere R11
* Unicenter Service Delivery R11
* Unicenter Service Level Management (USLM) R11
* Unicenter Application Performance Monitor R11
* Unicenter Service Desk R11
* Unicenter Service Desk Knowledge Tools R11
* Unicenter Service Fulfillment 2.2
* Unicenter Service Fulfillment R11
* Unicenter Asset Portfolio Management R11
* Unicenter Service Matrix Analysis R11
* Unicenter Service Catalog/Fulfillment/Accounting R11
* Unicenter MQ Management R11
* Unicenter Application Server Management R11
* Unicenter Web Server Management R11
* Unicenter Exchange Management R11
For BrightStor Storage Resource Manager and BrightStor Portal brugere, alle systemer der har iSponsors udrullet for at styre applikationer som Veritas Volume Manager og Tivoli TSM er også berørte af denne sårbarhed.
Note: Exploit kode er tilgængelig.
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, scan using the Network Software Inspector.
Løsning:
Opdatér til iGateway version 4.0.050623 eller senere.
ftp://ftp.ca.com/pub/iTech/downloads/
Rapporteret af / Kredit:
Erika Mendoza
Forløb:
14-10-2005: Producenten har udgivet en rettet version. Opdaterede beskrivelse, løsning og berørte produkter.
19-10-2005: Tilføjede patch download link til løsning.
Original Advisory:
http://www3.ca.com/threatinfo/vulninfo/vuln.aspx?id=33485
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
34 Relaterede Secunia Advisories, displaying 10
|
|
|
1. CA diverse produkter Ingres brugergodkendelse sikkerhedsproblem
|
|
2. CA BrightStor ARCServe Backup flere sårbarheder
|
|
3. CA Message Queuing Server buffer overflow
|
|
4. CA produkter CHM og RAR filhåndtering Denial of Service
|
|
5. CA produkter Alert Notification Server flere buffer overflows
|
|
6. CA produkter Ingres Database sårbarheder
|
|
7. BrightStor ARCserve Backup for Laptops & Desktops flere sårbarheder
|
|
8. CA Anti-Virus Engine CAB-arkivhåndtering buffer overflows
|
|
9. CA BrightStor ARCserve Backup Denial of Service sårbarheder
|
|
10. CA CleverPath Portal SQL-indsættelse
|
Vis alle relaterede advisories
|
|
|
Send Feedback to Secunia
|
|
Hvis du har ny information angående dette Secunia advisory eller et produkt i vores database, så send det venligst til os. Du kan sende det til os enten ved at bruge vores web formular eller ved at sende det til vuln@secunia.com.
Ideer, foreslag og andet feedback er også meget velkommen.
|
|
|
|
