|
CA Products Buffer Overflow and Privilege Escalation Vulnerabilities
|
|
Secunia Advisory:
|
SA25202
|
|
|
Release Date:
|
2007-05-11
|
|
Last Update:
|
2007-05-14
|
|
Popularity:
|
7,001 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Privilege escalation
System access
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | CA Anti-Spyware 8.x
CA Anti-Virus for the Enterprise 8.x
CA Threat Manager 8.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2007-2522
CVE-2007-2523
|
|
Description:
Two vulnerabilities have been reported in various CA products, which can be exploited by malicious users to gain escalated privileges and by malicious people to compromise a vulnerable system.
1) A boundary error within the inoweb service when processing Console Server login credentials can be exploited to cause a stack-based buffer overflow via sending a specially crafted packet with overly long username and password fields to port 12168/TCP.
Successful exploitation allows execution of arbitrary code but requires an installation on the x86 platform with the Console Server installed.
The vulnerability affects the following products:
* CA Anti-Virus for the Enterprise r8
* CA Threat Manager r8
* CA Anti-Spyware r8
* CA Protection Suites r3
2) The problem is that the Task Service component (InoTask.exe) uses a shared file mapping with a NULL security descriptor. This can be exploited by malicious users to cause a stack-based buffer overflow within InoCore.dll by modifying a certain string within the file mapping.
Successful exploitation allows execution of arbitrary code with SYSTEM privileges.
The vulnerability affects the following products:
* CA Anti-Virus for the Enterprise r8
* CA Threat Manager r8
Solution:
Patches are available via automatic updates.
Provided and/or discovered by:
1) Discovered by Tenable Network Security and reported via ZDI.
2) Discovered by binagres and reported via iDefense Labs.
Changelog:
2007-05-14: Added links to US-CERT.
Original Advisory:
CA:
http://supportconnectw.ca.com/public/antivirus/infodocs/caav-secnotice050807.asp
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-028.html
iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=530
Other References:
US-CERT VU#680616:
http://www.kb.cert.org/vuls/id/680616
US-CERT VU#788416:
http://www.kb.cert.org/vuls/id/788416
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
