Title: CA Secure Content Manager HTTP Gateway Service FTP Request

Vulnerabilities

CA Advisory Date: 2008-06-03

Reported By: Sebastian Apelt working with ZDI/TippingPoint

Cody Pierce, TippingPoint DVLabs

Impact: A remote attacker can cause a denial of service or execute

arbitrary code.

Summary: CA Secure Content Manager contains multiple

vulnerabilities in the HTTP Gateway service that can allow a

remote attacker to cause a denial of service condition or execute

arbitrary code. CA has issued a patch to address the

vulnerabilities. The vulnerabilities, CVE-2008-2541, occur due to

insufficient bounds checking on certain FTP requests. An attacker

can make a request that will cause the service to fail or allow

the attacker to take privileged action on the system.

Mitigating Factors: None

Severity: CA has given these vulnerabilities a maximum risk rating

of High.

Affected Products:

CA Secure Content Manager r8

Affected Platforms:

Windows

Status and Recommendation:

CA has issued the following patch to address the vulnerabilities.

CA Secure Content Manager r8: QO99987

How to determine if you are affected:

Windows:

1. Using a registry editor, determine if the following key exists:

HKEY_LOCAL_MACHINE\Software\ComputerAssociates\Hidden\PatchID\80VULNHOTF
IX

2. If the key does not exist, the installation is vulnerable

Workaround: None

References (URLs may wrap):

CA Support:

http://support.ca.com/

Security Notice for CA Secure Content Manager HTTP Gateway Service

https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1777
84

Solution Document Reference APARs:

QO99987

CA Security Response Blog posting:

CA Secure Content Manager HTTP Gateway Service FTP Request

Vulnerabilities

http://community.ca.com/blogs/casecurityresponseblog/archive/2008/06/04.
aspx

Reported By:

Sebastian Apelt working with ZDI/TippingPoint

Cody Pierce, TippingPoint DVLabs

CA ETrust Secure Content Manager Gateway FTP LIST Stack Overflow

Vulnerability

http://www.zerodayinitiative.com/advisories/ZDI-08-036/

CA ETrust Secure Content Manager Gateway FTP PASV Stack Overflow

Vulnerability

http://www.zerodayinitiative.com/advisories/ZDI-08-035/

CVE References:

CVE-2008-2541 - CA Secure Content Manager multiple FTP buffer

overflows

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2541

OSVDB References: Pending

http://osvdb.org/

Changelog for this advisory:

v1.0 - Initial Release

Customers who require additional information should contact CA

Technical Support at http://support.ca.com.

For technical questions or comments related to this advisory,

please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your

findings to vuln AT ca DOT com, or utilize our "Submit a

Vulnerability" form.

URL: http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx

Regards,

Ken Williams ; 0xE2941985

Director, CA Vulnerability Research

CA, 1 CA Plaza, Islandia, NY 11749

Contact http://www.ca.com/us/contact/

Legal Notice http://www.ca.com/us/legal/

Privacy Policy http://www.ca.com/us/privacy/

Copyright (c) 2008 CA. All rights reserved.

[ reply ]