[NT] CA Multiple Products Console Login and File Mapping Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

CA Multiple Products Console Login and File Mapping Vulnerabilities
------------------------------------------------------------------------

SUMMARY

CA Anti-Virus "for the Enterprise, CA Threat Manager, and CA Anti-Spyware
for the Enterprise contain multiple vulnerabilities that can allow an
attacker to cause a denial of service or possibly execute arbitrary code.
CA has issued patches to address the vulnerabilities".

Attackers can cause a denial of service or potentially execute arbitrary
code in multiple CA products.

DETAILS

Affected Products:
* CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) r8
* CA Threat Manager (formerly eTrust Integrated Threat Management) r8
* CA Anti-Spyware for the Enterprise (formerly eTrust PestPatrol) r8
* CA Protection Suites r3

The first vulnerability, CVE-2007-2522, is due to insufficient bounds
checking on Console Server login credentials. A remote attacker can use
carefully constructed authentication credentials to cause a stack based
buffer overflow, which can potentially result in arbitrary code execution.

The second vulnerability, CVE-2007-2523, is due to insufficient bounds
checking in InoCore.dll. A local attacker can modify the contents of a
file mapping to cause a stack based buffer overflow, which can potentially
result in arbitrary code execution. This issue only affects CA Anti-Virus
for the Enterprise and CA Threat Manager.

CA has given these vulnerabilities a combined High risk rating.

Mitigating Factors:
For CVE-2007-2522, the vulnerability applies only to an installation on
the x86 platform with the Console Server installed.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2522>
CVE-2007-2522
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2523>
CVE-2007-2523

Vendor Status:
CA has issued an update to address the vulnerabilities. The patched files
are available as part of the product's automatic content update. The
following components must be enabled in order to receive these updates:
eTrust ITM Console Server must be enabled to receive InoWeb.exe updates,
and eTrust ITM Common must be enabled to receive InoCore.dll updates.

ADDITIONAL INFORMATION

The information has been provided by CA Security Advisory.
The original article can be found at:

<http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=139626>

http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=139626

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.