Secunia

Two vulnerabilities have been reported in the CA Anti-Virus engine, which can be exploited by malicious people to compromise a vulnerable system.

1) A boundary error in vete.dll when processing CAB archives can be exploited to cause a stack-based buffer overflow via a specially crafted CAB archive containing overly long filenames.

2) An input validation error when processing the "coffFiles" field in CAB archives can be exploited to cause a stack-based buffer overflow.

Successful exploitation of the vulnerabilities allows execution of arbitrary code.

The vulnerabilities are reported in the following products:
* CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) r8, r8.1
* CA Anti-Virus 2007 (v8)
* eTrust EZ Antivirus r7, r6.1
* CA Internet Security Suite 2007 (v3)
* eTrust Internet Security Suite r1, r2
* eTrust EZ Armor r1, r2, r3.x
* CA Threat Manager for the Enterprise (formerly eTrust Integrated Threat Management) r8
* CA Protection Suites r2, r3
* CA Secure Content Manager (formerly eTrust Secure Content Manager) 8.0
* CA Anti-Virus Gateway (formerly eTrust Antivirus eTrust Antivirus Gateway) 7.1
* Unicenter Network and Systems Management (NSM) r3.0
* Unicenter Network and Systems Management (NSM) r3.1
* Unicenter Network and Systems Management (NSM) r11
* Unicenter Network and Systems Management (NSM) r11.1
* BrightStor ARCserve Backup r11.5
* BrightStor ARCserve Backup r11.1
* BrightStor ARCserve Backup r11 for Windows
* BrightStor Enterprise Backup r10.5
* BrightStor ARCserve Backup v9.01
* CA Common Services
* CA Anti-Virus SDK (formerly eTrust Anti-Virus SDK)

Solution
Content update 30.6 has been issued to address the vulnerabilities (please see the vendor's advisory for details).

Provided and/or discovered by
Discovered by an anonymous researcher and reported via ZDI.

Changelog
Further details available in Customer Area

Original Advisory
CA:
http://supportconnectw.ca.com/public/antivirus/infodocs/caantivirus-securitynotice.asp

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-034.html
http://www.zerodayinitiative.com/advisories/ZDI-07-035.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area