SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips
 

Vulnerability Note VU#105105

Computer Associates Anti-Virus engine fails to properly handle malformed CAB archives

Overview

The Computer Associates Anti-Virus engine contains a stack-based buffer overflow that may allow a remote, unauthenticated attacker to execute arbitrary code.

I. Description

The Computer Associates Anti-Virus engine contains a stack-based buffer overflow in the code responsible for processing CAB archives. Specifically, the Computer Associates Anti-Virus engine fails to properly validate the size of the coffFiles field in CAB archives before it is copied to a stack buffer. This may allow a stack-based buffer overflow to occur.

This vulnerability affects numerous Computer Associates products, including:

  • CA Anti-Virus
  • eTrust EZ Antivirus
  • CA Internet Security Suite 2007
  • eTrust Internet Security Suite
  • eTrust EZ Armor
  • CA Threat Manager
  • CA Protection Suites
  • CA Secure Content Manager
  • CA Anti-Virus Gateway
  • Unicenter Network and Systems Management
  • BrightStor ARCserve Backup
  • CA Common Services
  • CA Anti-Virus SDK (formerly eTrust Anti-Virus SDK)
More information is available in the Computer Associates Security Notice issued June 5th, 2007.

II. Impact

A remote, unauthenticated attacker may be able to execute arbitrary code or cause a denial-of-service condition..

III. Solution

Apply an Update

According to the Computer Associates Security Notice issued June 5th, 2007:

    CA has issued content update 30.6 to address the vulnerabilities. The updated engine is provided with content updates. Ensure the latest content update is installed if the signature version is less than version 30.6.

Systems Affected
VendorStatusDate Updated
Computer AssociatesVulnerable6-Jun-2007

References


http://supportconnectw.ca.com/public/antivirus/infodocs/caantivirus-securitynotice.asp
http://www.zerodayinitiative.com/advisories/ZDI-07-035.html
http://secunia.com/advisories/25570/

Credit

This vulnerability was reported by in Tipping Point advisory ZDI-07-035.

This document was written by Jeff Gennari.

Other Information

Date Public06/05/2007
Date First Published06/06/2007 01:45:26 PM
Date Last Updated06/06/2007
CERT Advisory 
CVE NameCVE-2007-2864
US-CERT Technical Alerts 
Metric15.19
Document Revision12

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2007 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader