|
|
|
|
| |
Credit:
The information has been provided by Williams, James K.
The original article can be found at: https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177784
|
| |
Vulnerable Systems:
* CA Secure Content Manager r8
This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Computer Associates eTrust SCM. Authentication is not required to exploit this vulnerability.
The specific flaw exists in the HTTP Gateway service icihttp.exe running on port 8080. When issuing a request for a FTP service the process tries to decorate the contents of the transaction. In this particular case by specifying a overly long response to a LIST command a stack buffer can be overflowed. Successful exploitation can lead to complete system compromise under the SYSTEM context.
Status and Recommendation:
CA has issued the following patch to address the vulnerabilities.
CA Secure Content Manager r8: QO99987
How to determine if you are affected:
Windows:
1. Using a registry editor, determine if the following key exists:
HKEY_LOCAL_MACHINE\Software\ComputerAssociates\Hidden\PatchID\80VULNHOTFIX
2. If the key does not exist, the installation is vulnerable
CVE Information:
CVE-2008-2541
|
|
|
|
|
