Signature Detail

HTTP: CA Multiple Product AV Engine CAB Header Parsing Stack Overflow

There exists a stack-based buffer overflow vulnerability in multiple Computer Associates products. The vulnerability exists in the component that processes CAB files. A remote unauthenticated attacker can exploit the vulnerability causing a denial of service condition or the execution of arbitrary code on the target system through delivering a specially crafted CAB file to the target. In an attack case where code injection is not successful, the affected application will terminate abnormally. In a more sophisticated attack where code injection results is successful, the behaviour of the target is entirely dependent on the intended function of the injected code. The code in such a case would execute within the security context of the affected application, normally

Extended Description

Multiple Computer Associates products are prone to a remote stack-based buffer-overflow vulnerability because the scan engine fails to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer. A successful exploit will allow an attacker to execute arbitrary code with SYSTEM-level privileges.

Affected Products

• Computer_associates anti-virus_2007 8
• Computer_associates anti-virus_sdk
• Computer_associates brightstor_arcserve_backup 10.5
• Computer_associates brightstor_arcserve_backup 11
• Computer_associates brightstor_arcserve_backup 11.1.0
• Computer_associates brightstor_arcserve_backup 11.5.0
• Computer_associates brightstor_arcserve_backup 9.01
• Computer_associates common_services 1.0.0
• Computer_associates common_services 1.1.0
• Computer_associates common_services 2.0.0
• Computer_associates common_services 2.1.0
• Computer_associates common_services 2.2.0
• Computer_associates common_services 3.0.0
• Computer_associates etrust_antivirus r8
• Computer_associates etrust_antivirus r8.1
• Computer_associates etrust_antivirus_for_the_gateway 7.1.0
• Computer_associates etrust_ez_antivirus 6.1.0
• Computer_associates etrust_ez_antivirus 7.0.0
• Computer_associates etrust_ez_armor 1.0.0
• Computer_associates etrust_ez_armor 2.0.0
• Computer_associates etrust_ez_armor 3.0.0
• Computer_associates etrust_ez_armor 3.1.0
• Computer_associates etrust_secure_content_manager 8.0.0
• Computer_associates integrated_threat_management r8
• Computer_associates internet_security_suite 1.0
• Computer_associates internet_security_suite 2.0
• Computer_associates internet_security_suite_2007 3.0
• Computer_associates protection_suites r3
• Computer_associates protection_suites_r2
• Computer_associates unicenter_network_and_systems_management 11
• Computer_associates unicenter_network_and_systems_management 11.1
• Computer_associates unicenter_network_and_systems_management 3.0.0
• Computer_associates unicenter_network_and_systems_management 3.1.0

References

• BugTraq: 24330
• CVE: CVE-2007-2864