Title: 32919 - Computer Associates Message Queuing (CAM/CAFT)
multiple vulnerabilities
CA Vulnerability ID: CAID 32919
Disclosure Date: 2005-08-19
Discovered By: CA internal audit
Impact: Remote attackers can execute arbitrary code, or cause a
denial of service condition.
Summary: During a recent internal audit, CA discovered several
vulnerability issues in the CA Message Queuing (CAM / CAFT)
software.
1) Attackers can potentially exploit a CAM TCP port vulnerability
to execute a Denial of Service (DoS) attack.
2) Attackers can potentially exploit multiple buffer overflow
conditions to execute arbitrary code remotely with elevated
privileges.
3) Attackers can potentially launch a spoofed CAFT attack, and
execute arbitrary commands with elevated privileges.
CA has made patches available for all affected users. These
vulnerabilities affect all versions of the CA Message Queuing
software prior to v1.07 Build 220_13 and v1.11 Build 29_13 on the
platforms specified below.
Severity: Computer Associates has given this vulnerability a High
risk rating.
Determining CAM versions:
Simply running camstat will return the version information in the
top line of the output on any platform. The camstat program is
located in the "bin" subfolder of the installation directory.
The example below indicates that CAM version 1.11 build 27
increment 2 is running.
E:\>camstat
CAM - machine.ca.com Version 1.11 (Build 27_2) up 0 days 1:16
Determining the CAM install directory:
Windows: the install location is specified by the %CAI_MSQ%
environment variable.
Unix/Linux/Mac: the /etc/catngcampath text file holds the CAM
install location.
Affected products:
Unicenter Performance Management for OpenVMS r2.4 SP3
AdviseIT 2.4
Advantage Data Transport 3.0
BrightStor SAN Manager 1.1, 1.1 SP1, 1.1 SP2, 11.1
BrightStor Portal 11.1
CleverPath OLAP 5.1
CleverPath ECM 3.5
CleverPath Predictive Analysis Server 2.0, 3.0
CleverPath Aion 10.0
eTrust Admin 2.01, 2.04, 2.07, 2.09, 8.0, 8.1
Unicenter Application Performance Monitor 3.0, 3.5
Unicenter Asset Management 3.1, 3.2, 3.2 SP1, 3.2 SP2, 4.0,
4.0 SP1
Unicenter Data Transport Option 2.0
Unicenter Enterprise Job Manager 1.0 SP1, 1.0 SP2
Unicenter Jasmine 3.0
Unicenter Management for WebSphere MQ 3.5
Unicenter Management for Microsoft Exchange 4.0, 4.1
Unicenter Management for Lotus Notes/Domino 4.0
Unicenter Management for Web Servers 5, 5.0.1
Unicenter NSM 3.0, 3.1
Unicenter NSM Wireless Network Management Option 3.0
Unicenter Remote Control 6.0, 6.0 SP1
Unicenter Service Level Management 3.0, 3.0.1, 3.0.2, 3.5
Unicenter Software Delivery 3.0, 3.1, 3.1 SP1, 3.1 SP2, 4.0,
4.0 SP1
Unicenter TNG 2.1, 2.2, 2.4, 2.4.2
Unicenter TNG JPN 2.2
Affected platforms:
AIX, DG Intel, DG Motorola, DYNIX, OSF1, HP-UX, IRIX,
Linux Intel, Linux s/390, Solaris Intel, Solaris Sparc, UnixWare,
Windows, Apple Mac, AS/400, MVS, NetWare, OS/2, and OpenVMS.
Status: Patches that completely remediate this vulnerability
issue are available for all affected products.
Recommendation (note that URLs may wrap):
CA strongly recommends application of the appropriate patch(es).
Fixes for CAM v1.11 prior to Build 29_13:
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_cam111fi
xes.asp
Windows QO71014
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7101
4
AIX QO71015
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7101
5
HPUX QO71016
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7101
6
Linux QO71019
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7101
9
QO71020 (RPM_i386)
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
0
QO71021 (RPM_ia64)
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
1
LinuxS390 QO71031
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7103
1
MacOSX QO71022
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
2
NetWare QO71023
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
3
OSF1 QO71024
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
4
SCO QO71025
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
5
Solaris QO71026
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
6
SolarisIntel QO71027
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
7
Fixes for CAM v1.07 prior to Build 220_13
and Fixes for CAM v1.05 (any version):
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_cam107fi
xes.asp
Windows QO71033
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7103
3
AIX QO71035
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7103
5
AS/400 On Request
http://supportconnect.ca.com
DGIntel QO71036
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7103
6
DGM88K QO71037
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7103
7
DYNIX QO71038
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7103
8
HPUX QO71040
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
0
IRIX QO71041
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
1
Linux QO71042
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
2
LinuxS390 QO71085
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7108
5
NCR QO71043
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
3
NetWare QO71044
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
4
OS/2 On Request
http://supportconnect.ca.com
OSF1 QO71045
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
5
SCO QO71046
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
6
SINIX QO71047
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
7
Solaris QO71048
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
8
SolarisIntel QO71049
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
9
Unixware7 QO71050
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7105
0
OpenVMS On Request
http://supportconnect.ca.com
Customers wishing to patch their Master Image CD sets should
refer to the solution areas on the product home pages
(http://supportconnectw.ca.com/main.asp).
USD/SDO package for the CA Message Queuing vulnerability
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_faqs.asp
#faqsdo
UAM/AMO Definitions for the CA Message Queuing vulnerability
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_faqs.asp
#faqamo
CVE Reference: Pending
OSVDB Reference: Pending
Advisory URLs (note that URLs may wrap):
CA Message Queuing Security Notice
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_notice.a
sp
CA Security Advisor site: CAID 32919 - Computer Associates
Message Queuing (CAM/CAFT) multiple vulnerabilities
http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=32919
CA Message Queuing Security Notice Frequently Asked Questions
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_faqs.asp
Should you require additional information, please contact CA
Customer Support at http://supportconnect.ca.com.
CA Customer Support North America (individual product hotlines)
http://supportconnectw.ca.com/public/ca_common_docs/support_dir.pdf
CA International Customer Support (individual country offices)
http://www.ca.com/camap.htm
Respectfully,
Ken Williams ; Dir. Vuln Research
Computer Associates ; 0xE2941985
Computer Associates International, Inc. (CA).
One Computer Associates Plaza. Islandia, NY 11749
Contact Us http://ca.com/catalk.htm
Legal Notice http://ca.com/calegal.htm
Privacy Policy http://ca.com
Copyright 2005 Computer Associates International, Inc.
All rights reserved
--
NTBugtraq Editor's Note:
Most viruses these days use spoofed email addresses. As such, using an
Anti-Virus product which automatically notifies the perceived sender of a
message it believes is infected may well cause more harm than good. Someone who
did not actually send you a virus may receive the notification and scramble
their support staff to find an infection which never existed in the first
place. Suggest such notifications be disabled by whomever is responsible for
your AV, or at least that the idea is considered.
--
