Multiple Computer Associates (CA) Anti-Virus engine coffFiles buffer overflow
| ca-multiple-antivirus-cofffiles-bo (34737) |  High Risk |
Description:
Multiple CA products are vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the Anti-Virus engine when handling CAB files. By sending a specially-crafted CAB file containing a malicious coffFiles field, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
Platforms Affected:
- CA, Anti-Virus 2007 8.0
- CA, Anti-Virus for the Enterprise 8
- CA, Anti-Virus for the Enterprise 8.1
- CA, Anti-Virus Gateway 7.1
- CA, AntiVirus SDK
- CA, BrightStor ARCserve Backup 11.1
- CA, BrightStor ARCserve Backup 11.5
- CA, BrightStor ARCserve Backup 9.01
- CA, BrightStor ARCserve Backup for Windows 11
- CA, BrightStor Enterprise Backup 10.5
- CA, Common Services
- CA, eTrust Antivirus 8
- CA, eTrust Antivirus 8.1
- CA, eTrust Antivirus Gateway 7.1
- CA, eTrust EZ Antivirus 6.1
- CA, eTrust EZ Antivirus 7.0
- CA, eTrust EZ Armor 1
- CA, eTrust EZ Armor 2.0
- CA, eTrust EZ Armor 3
- CA, eTrust Integrated Threat Management 8.0
- CA, eTrust Internet Security Suite 1
- CA, eTrust Internet Security Suite 2
- CA, eTrust Secure Content Manager 8.0
- CA, Internet Security Suite 2007
- CA, Protection Suites 2
- CA, Protection Suites 3.0
- CA, Secure Content Manager 8.0
- CA, Threat Manager 8 Enterprise
- CA, Unicenter NSM 11
- CA, Unicenter NSM 11.1
- CA, Unicenter NSM 3.0
- CA, Unicenter NSM 3.1
Remedy:
Refer to CA SupportConnect June 5th, 2007 for patch, upgrade, or suggested workaround information. See References.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Thu Jun 07 2007 - 10:43:02 CDT, [CAID 35395, 35396]: CA Anti-Virus Engine CAB File Buffer Overflow Vulnerabilities at http://archives.neohapsis.com/archives/bugtraq/2007-06/0094.html.
- CA SupportConnect June 5th, 2007, Security Notice for CA products implementing the Anti-Virus engine at http://supportconnectw.ca.com/public/antivirus/infodocs/caantivirus-securitynotice.asp.
- ZDI-07-035, CA Multiple Product AV Engine CAB Header Parsing Stack Overflow Vulnerability at http://www.zerodayinitiative.com/advisories/ZDI-07-035.html.
- BID-24330: Computer Associates Multiple Products Remote Stack Buffer Overflow Vulnerability
- CVE-2007-2864: Stack-based buffer overflow in the Anti-Virus engine before content update 30.6 in multiple CA (formerly Computer Associates) products allows remote attackers to execute arbitrary code via a large invalid value of the coffFiles field in a .CAB file.
- OSVDB ID: 35245: CA Anti-Virus Engine CAB Header Parsing Overflow
- SA25570: CA Anti-Virus Engine CAB Archive Processing Buffer Overflows
- SECTRACK ID: 1018199: CA Antivirus Stack Overflows in Processing Filenames and the `coffFiles` Parameter in CAB Files Lets Remote Users Execute Arbitrary Code
- US-CERT VU#105105: Computer Associates Anti-Virus engine fails to properly handle malformed CAB archives
- VUPEN/ADV-2007-2072: CA Products Anti-Virus Engine CAB File Handling Remote Code Execution Vulnerabilities
Reported:
Jun 05, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net