The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Computer Associates Alert Notification Service Multiple RPC Buffer
Overflow Vulnerabilities
------------------------------------------------------------------------
SUMMARY
Computer Associates Alert Notification Server is used by several CA
products, including eTrust Integrated Threat Management, to provide
notifications to console users. Remote exploitation of multiple buffer
overflow vulnerabilities in Computer Associates International Inc.'s Alert
Notification Service may allow an authenticated attacker to execute
arbitrary code with SYSTEM privileges.
DETAILS
Vulnerable Systems:
* Computer Associates' Threat Manager for the Enterprise version 8.1
The Alert Service is a component of multiple Computer Associates'
products. It is used to provide status updates and notifications regarding
various system events. It implements an RPC interface with GUID
3d742890-397c-11cf-9bf1-00805f88cb72.
Multiple buffer overflows exist in the handlers for various opcodes. In
each case, unsafe library functions are used to copy attacker supplied
data into fixed size stack buffers. By making specially crafted requests,
attackers are able to cause an exploitable buffer overflow.
Analysis:
Exploitation of these vulnerabilities allows an attacker to execute
arbitrary code with SYSTEM privileges. In order to exploit these
vulnerabilities, it is necessary for an attacker to have valid domain
credentials.
Vendor response:
Computer Associates has addressed these issues by providing updates. More
information is available in their advisory at the following URL:
<https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=173103>
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=173103
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4620>
CVE-2007-4620
Disclosure timeline:
08/24/2007 - Initial vendor notification
08/24/2007 - Initial vendor response
04/03/2008 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=679>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=679
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
