Secunia CSI7
Create Profile
Our Commitment
Advisories by Product
Advisories by Vendor
Report Vulnerability
Insecure Library Loading
Moderately critical

CA Products iGateway Service Content-Length Buffer Overflow


Release Date:  2006-01-24    Last Update:  2006-01-27    Views:  18,232

Secunia Advisory SA18591


From local network


System access

Solution Status:

Vendor Patch


CVE Reference(s):


Erika Mendoza has reported a vulnerability in various CA products, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the handling of HTTP data in the iGateway component. This can be exploited to cause a heap-based buffer overflow by supplying a negative value for the "Content-Length" HTTP header.

Successful exploitation allows execution of arbitrary code, but requires access to the iGateway service at port 5250/tcp.

The vulnerability has been reported in versions of iGateway prior to 4.0.051230, which is included with the following products:

BrightStor ARCserve Backup r11.5
BrightStor ARCserve Backup r11.1
BrightStor ARCserve Backup for Windows r11
BrightStor Enterprise Backup 10.5
BrightStor ARCserve Backup v9.01
BrightStor ARCserve Backup Laptop & Desktop r11.1
BrightStor ARCserve Backup Laptop & Desktop r11
BrightStor Process Automation Manager r11.1
BrightStor SAN Manager r11.1
BrightStor SAN Manager r11.5
BrightStor Storage Resource Manager r11.5
BrightStor Storage Resource Manager r11.1
BrightStor Storage Resource Manager 6.4
BrightStor Storage Resource Manager 6.3
BrightStor Portal 11.1
eTrust Audit 1.5 SP2 (iRecorders and ARIES)
eTrust Audit 1.5 SP3 (iRecorders and ARIES)
eTrust Audit 8.0 (iRecorders and ARIES)
eTrust Admin 8.1
eTrust Identity Minder 8.0
eTrust Secure Content Manager (SCM) R8
eTrust Integrated Threat Management (ITM) R8
eTrust Directory, R8.1 (Web Components Only)
Unicenter CA Web Services Distributed Management R11
Unicenter AutoSys JM R11
Unicenter Management for WebLogic / Management for WebSphere R11
Unicenter Service Delivery R11
Unicenter Service Level Management (USLM) R11
Unicenter Application Performance Monitor R11
Unicenter Service Desk R11
Unicenter Service Desk Knowledge Tools R11
Unicenter Asset Portfolio Management R11
Unicenter Service Metric Analysis R11
Unicenter Service Catalog/Assure/Accounting R11
Unicenter MQ Management R11
Unicenter Application Server Management R11
Unicenter Web Server Management R11
Unicenter Exchange Management R11

For BrightStor Storage Resource Manager and BrightStor Portal users, all hosts that have iSponsors deployed to them for managing applications like Veritas Volume Manager and Tivoli TSM are also affected by this vulnerability.

Update the iGateway component to version 4.0.051230 or later.

Further details available to Secunia VIM customers

Provided and/or discovered by:
Erika Mendoza

Original Advisory:
Computer Associates:


Deep Links:
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to

Subject: CA Products iGateway Service Content-Length Buffer Overflow

No posts yet


You must be logged in to post a comment.

 Products Solutions Customers Partner Resources Company
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
Technology Partners
 About us

© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability