Executive Summary

Summary
Title Computer Associates Anti-Virus engine fails to properly handle malformed CAB archives
Informations
Name VU#105105 First vendor Publication 2007-06-06
Vendor VU-CERT Last vendor Modification 2007-06-06
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#105105

Computer Associates Anti-Virus engine fails to properly handle malformed CAB archives

Overview

The Computer Associates Anti-Virus engine contains a stack-based buffer overflow that may allow a remote, unauthenticated attacker to execute arbitrary code.

I. Description

The Computer Associates Anti-Virus engine contains a stack-based buffer overflow in the code responsible for processing CAB archives. Specifically, the Computer Associates Anti-Virus engine fails to properly validate the size of the coffFiles field in CAB archives before it is copied to a stack buffer. This may allow a stack-based buffer overflow to occur.

This vulnerability affects numerous Computer Associates products, including:

  • CA Anti-Virus
  • eTrust EZ Antivirus
  • CA Internet Security Suite 2007
  • eTrust Internet Security Suite
  • eTrust EZ Armor
  • CA Threat Manager
  • CA Protection Suites
  • CA Secure Content Manager
  • CA Anti-Virus Gateway
  • Unicenter Network and Systems Management
  • BrightStor ARCserve Backup
  • CA Common Services
  • CA Anti-Virus SDK (formerly eTrust Anti-Virus SDK)
More information is available in the Computer Associates Security Notice issued June 5th, 2007.

II. Impact

A remote, unauthenticated attacker may be able to execute arbitrary code or cause a denial-of-service condition..

III. Solution

Apply an Update

According to the Computer Associates Security Notice issued June 5th, 2007:

    CA has issued content update 30.6 to address the vulnerabilities. The updated engine is provided with content updates. Ensure the latest content update is installed if the signature version is less than version 30.6.

Systems Affected

VendorStatusDate Updated
Computer AssociatesVulnerable6-Jun-2007

References


http://supportconnectw.ca.com/public/antivirus/infodocs/caantivirus-securitynotice.asp
http://www.zerodayinitiative.com/advisories/ZDI-07-035.html
http://secunia.com/advisories/25570/

Credit

This vulnerability was reported by in Tipping Point advisory ZDI-07-035.

This document was written by Jeff Gennari.

Other Information

Date Public06/05/2007
Date First Published06/06/2007 01:45:26 PM
Date Last Updated06/06/2007
CERT Advisory 
CVE NameCVE-2007-2864
Metric15.19
Document Revision12

Original Source

Url : http://www.kb.cert.org/vuls/id/105105

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 5
Application 6
Application 2
Application 1
Application 1
Application 2
Application 4
Application 1
Application 3
Application 4
Application 1
Application 2

SAINT Exploits

Description Link
CA Antivirus engine CAB handling buffer overflow More info here

Open Source Vulnerability Database (OSVDB)

Id Description
35245 CA Anti-Virus Engine CAB Header Parsing Overflow

A buffer overflow exists in multiple CA products. The Anti-Virus engine fails to validate CAB files resulting in a stack overflow. With a specially crafted CAB file containing a malformed "coffFiles" field, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.
35244 CA Anti-Virus Engine CAB Archive Filename Parsing Overflow

A buffer overflow exists in multiple CA products. The Anti-Virus engine fails to validate CAB archive files resulting in a stack overflow. With a specially crafted CAB containing a file with a long filename, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

Snort® IPS/IDS

Date Description
2014-01-10 CA multiple product AV engine CAB header parsing stack overflow attempt
RuleID : 16719 - Revision : 8 - Type : FILE-OTHER