Title: [CAID 35515]: CA Products Alert Service RPC Procedure

Buffer Overflow Vulnerabilities

CA Vuln ID (CAID): 35515

CA Advisory Date: 2007-07-17

Reported By: Anonymous researcher working with the iDefense VCP

Impact: Remote attacker can cause a denial of service or execute

arbitrary code.

Summary: Multiple CA products that utilize Alert service

functionality contain multiple vulnerabilities. The

vulnerabilities, CVE-2007-3825, are due to insufficient bounds

checking on received data by certain RPC procedures. An attacker

can exploit these buffer overflows to execute arbitrary code or

cause service failure.

Mitigating Factors: None

Severity: CA has given these vulnerabilities a High risk rating.

Affected Products:

CA Threat Manager for the Enterprise (formerly eTrust Integrated

Threat Management) r8

CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) r8

CA Protection Suites r3

BrightStor ARCserve Backup r11.5

BrightStor ARCserve Backup r11.1

BrightStor ARCserve Backup r11 for Windows

BrightStor Enterprise Backup r10.5

BrightStor ARCserve Backup v9.01

BrightStor ARCserve Client agent for Windows

Affected Platforms:

Microsoft Windows

Status and Recommendation:

CA recommends that customers apply the update to address the

vulnerabilities. The updated Alert service must be manually

installed. For all affected products, apply QO89817.

http://supportconnectw.ca.com/public/antivirus/infodocs/caantivirus-secn
otice.asp

How to determine if you are affected:

1. Using Windows Explorer, locate the file "alert.exe". By

default, the file is located in the

"C:\Program Files\CA\SharedComponents\Alert" directory.

2. Right click on the file and select Properties.

3. Select the Version tab.

4. If the "alert.exe" file version is less than 8.0.255.0, the

installation is vulnerable.

Workaround: None

References (URLs may wrap):

CA SupportConnect:

http://supportconnect.ca.com/

Security Notice for CA products running the Alert service

http://supportconnectw.ca.com/public/antivirus/infodocs/caantivirus-secn
otice.asp

Solution Document Reference APARs:

QO89817

CA Security Advisor posting:

CA Products Alert Service RPC Procedures Buffer Overflow

Vulnerabilities

http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=149081

CA Vuln ID (CAID): 35515

http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35515

Reported By: iDefense

iDefense Advisory:

Computer Associates Alert Notification Server Multiple Buffer

Overflow Vulnerabilities

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=561

CVE References:

CVE-2007-3825

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3825

OSVDB References: Pending

http://osvdb.org/

Changelog for this advisory:

v1.0 - Initial Release

Customers who require additional information should contact CA

Technical Support at http://supportconnect.ca.com.

For technical questions or comments related to this advisory,

please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your

findings to vuln AT ca DOT com, or utilize our "Submit a

Vulnerability" form.

URL: http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx

Regards,

Ken Williams ; 0xE2941985

Director, CA Vulnerability Research

CA, 1 CA Plaza, Islandia, NY 11749

Contact http://www.ca.com/us/contact/

Legal Notice http://www.ca.com/us/legal/

Privacy Policy http://www.ca.com/us/privacy/

Copyright (c) 2007 CA. All rights reserved.

[ reply ]