Signature Detail
Short Name |
HTTP:STC:ACTIVEX:ADDCOLUMN |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
CA BrightStor ARCserve Backup AddColumn ActiveX Buffer Overflow |
Release Date |
2008/03/25 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: CA BrightStor ARCserve Backup AddColumn ActiveX Buffer Overflow
This signature detects attempts to exploit a known vulnerability in CA BrightStor ARCserve Backup ActiveX Control (ListCtrl.ocx). An attacker can create a malicious Web site containing Web pages with dangerous ActiveX calls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.
Extended Description
The Unicenter DSM r11 List Control ATX ActiveX control, included with CA BrightStor ARCserve Backup, is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. An attacker can exploit this issue to execute arbitrary code in the context of an application running the control (typically Internet Explorer). Failed attacks will cause denial-of-service conditions.
Affected Products
- Computer Associates ARCserve Backup for Laptops and Desktops 11.5
- Computer Associates Desktop Management Suite 11.1
- Computer Associates Desktop Management Suite 11.2
- Computer Associates Desktop Management Suite 11.2a
- Computer Associates Desktop Management Suite 11.2 C1
- Computer Associates ListCtrl.ocx (Unicenter DSM r11 List Control ATX) 11.2.3.1895
- Computer Associates Unicenter Asset Management 11.1
- Computer Associates Unicenter Asset Management 11.2
- Computer Associates Unicenter Asset Management 11.2a
- Computer Associates Unicenter Asset Management 11.2 C1
- Computer Associates Unicenter Desktop Management Bundle 11.1
- Computer Associates Unicenter Desktop Management Bundle 11.2
- Computer Associates Unicenter Desktop Management Bundle 11.2a
- Computer Associates Unicenter Desktop Management Bundle 11.2 C1
- Computer Associates Unicenter Remote Control 11.1
- Computer Associates Unicenter Remote Control 11.2
- Computer Associates Unicenter Remote Control 11.2a
- Computer Associates Unicenter Remote Control 11.2 C1
- Computer Associates Unicenter Software Delivery 11.1
- Computer Associates Unicenter Software Delivery 11.2
- Computer Associates Unicenter Software Delivery 11.2a
- Computer Associates Unicenter Software Delivery 11.2 C1
References
- BugTraq: 28268
- CVE: CVE-2008-1472