Title: [CAID 35515]: CA Products Alert Service RPC Procedure Buffer Overflow Vulnerabilities CA Vuln ID (CAID): 35515 CA Advisory Date: 2007-07-17 Reported By: Anonymous researcher working with the iDefense VCP Impact: Remote attacker can cause a denial of service or execute arbitrary code. Summary: Multiple CA products that utilize Alert service functionality contain multiple vulnerabilities. The vulnerabilities, CVE-2007-3825, are due to insufficient bounds checking on received data by certain RPC procedures. An attacker can exploit these buffer overflows to execute arbitrary code or cause service failure. Mitigating Factors: None Severity: CA has given these vulnerabilities a High risk rating. Affected Products: CA Threat Manager for the Enterprise (formerly eTrust Integrated Threat Management) r8 CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) r8 CA Protection Suites r3 BrightStor ARCserve Backup r11.5 BrightStor ARCserve Backup r11.1 BrightStor ARCserve Backup r11 for Windows BrightStor Enterprise Backup r10.5 BrightStor ARCserve Backup v9.01 BrightStor ARCserve Client agent for Windows Affected Platforms: Microsoft Windows Status and Recommendation: CA recommends that customers apply the update to address the vulnerabilities. The updated Alert service must be manually installed. For all affected products, apply QO89817. http://supportconnectw.ca.com/public/antivirus/infodocs/caantivirus-secnotice.asp How to determine if you are affected: 1. Using Windows Explorer, locate the file "alert.exe". By default, the file is located in the "C:\Program Files\CA\SharedComponents\Alert" directory. 2. Right click on the file and select Properties. 3. Select the Version tab. 4. If the "alert.exe" file version is less than 8.0.255.0, the installation is vulnerable. Workaround: None References (URLs may wrap): CA SupportConnect: http://supportconnect.ca.com/ Security Notice for CA products running the Alert service http://supportconnectw.ca.com/public/antivirus/infodocs/caantivirus-secnotice.asp Solution Document Reference APARs: QO89817 CA Security Advisor posting: CA Products Alert Service RPC Procedures Buffer Overflow Vulnerabilities http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=149081 CA Vuln ID (CAID): 35515 http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35515 Reported By: iDefense iDefense Advisory: Computer Associates Alert Notification Server Multiple Buffer Overflow Vulnerabilities http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=561 CVE References: CVE-2007-3825 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3825 OSVDB References: Pending http://osvdb.org/ Changelog for this advisory: v1.0 - Initial Release Customers who require additional information should contact CA Technical Support at http://supportconnect.ca.com. For technical questions or comments related to this advisory, please send email to vuln AT ca DOT com. If you discover a vulnerability in CA products, please report your findings to vuln AT ca DOT com, or utilize our "Submit a Vulnerability" form. URL: http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx Regards, Ken Williams ; 0xE2941985 Director, CA Vulnerability Research CA, 1 CA Plaza, Islandia, NY 11749 Contact http://www.ca.com/us/contact/ Legal Notice http://www.ca.com/us/legal/ Privacy Policy http://www.ca.com/us/privacy/ Copyright (c) 2007 CA. All rights reserved.
