CA eTrust AntiVirus inoweb Buffer Overflow Vulnerability (CVE-2007-2522)

Vulnerability Key Information Vulnerability Overview Title: CA eTrust AntiVirus Server inoweb Buffer Overflow Vulnerability ID: ZDI-07-028, ZDI-CAN-104 CVE ID: CVE-2007-2522 CVSS Score: Not provided Affected Scope Affected Vendor: Computer Associates Affected Product: eTrust AntiVirus Vulnerability Details Risk Description: Attackers can execute arbitrary code on vulnerable Computer Associates AntiVirus Server. Exploitation of this vulnerability does not require user interaction. Specific Vulnerability: The vulnerability exists in the authentication functionality of the inoweb service, which by default listens on TCP port 12168. When copying username and password values into a fixed-length stack buffer, if an attacker provides overly long parameter values, it results in an exploitable buffer overflow. Additional Details Vendor Response: Computer Associates has released an update to fix this vulnerability. More information is available at: http://supportconnectw.ca.com/public/antivirus/infodocs/caav-secnotice050807.asp Disclosure Timeline 2006-11-06: Vulnerability reported to vendor 2007-05-10: Coordinated public disclosure Contributors Contributor: Tenable Network Security Mitigation Measures Trend Micro Customer Protection: Trend Micro TippingPoint IPS customers are protected via Digital Vaccine filter ID ['4861']. For more information on TippingPoint IPS, visit: http://www.tippingpoint.com

Goal Reached Thanks to every supporter — we hit 100%!

CA eTrust AntiVirus inoweb Buffer Overflow Vulnerability (CVE-2007-2522)