CAID 32896 - Computer Associates Vet Antivirus engine heap overflow vulnerability
CAID 32896 - Computer Associates Vet Antivirus engine heap overflow
vulnerability
CA Vulnerability ID: 32896
Discovery Date: 2005/04/26
Discovered By: Alex Wheeler
Title:
Computer Associates Vet Antivirus engine heap overflow vulnerability
Impact:
Remote attackers can gain privileged access.
Summary:
Computer Associates has patched a high risk vulnerability that was
identified by Alex Wheeler. The vulnerability affects computers
leveraging our eTrust(TM) Vet Antivirus engine, and can allow an
attacker to gain control of a computer through a specially crafted
Microsoft Office document.
Severity:
Computer Associates has given this vulnerability a High risk rating.
The Vet Antivirus Engine is included in drivers, system services to
automatically scan any files that the computer may access. These
software components have privileged access to the local computer and
are started by default by our Antivirus software installation. In
the worst case scenario, a remote attacker may present a specially
crafted Microsoft Office document to a vulnerable computer for virus
scanning and gain control of the computer without any user
interaction.
Affected corporate products:
CA InoculateIT 6.0 (all platforms, including Notes/Exchange)
eTrust Antivirus r6.0 (all platforms, including Notes/Exchange)
eTrust Antivirus r7.0 (all platforms, including Notes/Exchange)
eTrust Antivirus r7.1 (all platforms, including Notes/Exchange)
eTrust Antivirus for the Gateway r7.0 (all modules and platforms)
eTrust Antivirus for the Gateway r7.1 (all modules and platforms)
eTrust Secure Content Manager (all releases)
eTrust Intrusion Detection (all releases)
BrightStor ARCserve Backup (BAB) r11.1 Windows
Affected retail products:
eTrust EZ Antivirus r6.2 - r7.0.5
eTrust EZ Armor r1.0 - r2.4.4
eTrust EZ Armor LE r2.0 - r3.0.0.14
Vet Antivirus r10.66 and below
Status:
All Computer Associates corporate products and some of our retail
products that utilize the Vet Antivirus Engine have the ability to
patch this vulnerability automatically. For these products, the
patch for this vulnerability was already rolled out as part of the
daily Vet Signature updates on May 3, 2005, and no further action
is required.
Recommendation:
To make sure your system is protected, please review the solutions
below for your specific product version.
* All corporate products - You are protected if you are running
Vet engine 11.9.1 or later. If running an earlier version,
perform a virus signature file update as soon as possible to
receive the patch.
* eTrust EZ Antivirus r7/eTrust EZ Armor r3.1 Users - You may
already be up-to-date. A new Vet engine was made available on
Tuesday, May 3rd. Automatic signature file updates should have
downloaded this update to your system. To verify the update,
please follow the instructions below:
Open eTrust EZ Antivirus (double-click on the "AV" icon in your
system tray), then select the "Help" tab on the top-right of the
screen. The engine version should be listed as 11.9.1 or later.
If it is a lower number, perform a virus signature file update [1]
immediately to receive the patch.
* eTrust EZ Antivirus r6.x Users - Upgrade to eTrust EZ Antivirus r7
as soon as possible. It takes approximately 10 minutes to
complete this process on a high-speed connection, and all users
with an active license are entitled to this upgrade for free.
Follow the link below to upgrade now.
http://consumerdownloads.ca.com/myeTrust/apps/EZAntivirus.exe
- For additional upgrade instructions, click on the appropriate
link below:
- Upgrading from r6.1 and above [2]
- Upgrading from r6.0 and earlier [3]
Unsure of your product version? Follow the link in footnote [4].
* eTrust EZ Armor r3 Users - An update will be pushed down to your
computer. During a virus signature file update, a patch will be
downloaded to your computer. The patch will require that you
reboot your computer for it to take effect. We recommend that
you reboot right away.
* eTrust EZ Armor r2.4.4 and below Users - Upgrade to eTrust EZ
Armor r3.1 as soon as possible. It takes approximately 10
minutes to complete this process on a high-speed connection and
all users with an active license are entitled to this upgrade for
free. Follow the link below to upgrade now.
http://consumerdownloads.ca.com/myeTrust/apps/EZArmor.exe
Unsure of your product version? Follow the link in footnote [4].
CVE Reference: Pending
OSVDB Reference: Pending
Advisory URLs (note that URLs below may wrap):
General:
http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=32896
Consumer:
http://crm.my-etrust.com/login.asp?username=guest&target=DOCUMENT&openpa
rameter=1588
[1]
http://crm.my-etrust.com/login.asp?username=guest&target=DOCUMENT&openpa
rameter=61
[2]
http://crm.my-etrust.com/login.asp?username=guest&target=DOCUMENT&openpa
rameter=1907
[3]
http://crm.my-etrust.com/login.asp?username=guest&target=DOCUMENT&openpa
rameter=1911
[4]
http://crm.my-etrust.com/login.asp?username=guest&target=DOCUMENT&openpa
rameter=89
Should you require additional information, please contact CA
Technical Support at http://supportconnect.ca.com.
Respectfully,
Ken Williams ; Vulnerability Research
A9F9 44A6 B421 FF7D 4000 E6A9 7925 91DF E294 1985
Computer Associates International, Inc. (CA).
One Computer Associates Plaza. Islandia, NY 11749
Contact Us http://ca.com/catalk.htm
Legal Notice http://ca.com/calegal.htm
Privacy Policy http://ca.com
Copyright 2005 Computer Associates International, Inc.
All rights reserved