Signature Detail
Short Name |
HTTP:STC:ACTIVEX:CA-XMLSECDB |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
CA Internet Security Suite XMLSecDB ActiveX Vulnerability |
Release Date |
2011/03/07 |
Update Number |
1877 |
Supported Platforms |
idp-4.0.110090709+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: CA Internet Security Suite XMLSecDB ActiveX Vulnerability
This signature detects attempts to exploit a known insecure file creation vulnerability in CA Internet Security Suite. It is due to an error when the XMLSecDB ActiveX control, which is installed with the HIPSEngine component, handles SetXml and Save methods. A remote unauthenticated attacker can exploit this by enticing a target user to open a maliciously crafted HTML page. A successful attack can allow attackers to execute arbitrary code within the context of the current user.
Extended Description
CA Host-Based Intrusion Prevention System(HIPS) is prone to a remote code-execution vulnerability. An attacker can exploit this vulnerability to execute arbitrary code in the context of the logged-in user. Failed exploits result in denial-of-service conditions. Internet Security Suite 2008 is vulnerable; other versions may also be affected.
Affected Products
- Computer Associates Host-Based Intrusion Prevention System R8.1
- Computer Associates Internet Security Suite 2010
- Computer Associates Internet Security Suite 2011
References
- BugTraq: 46539
- CVE: CVE-2011-1036