iDEFENSE Labs
02/03/05, 19:55
Computer Associates License Client/Server GCR Checksum Buffer Overflow=20
iDEFENSE Security Advisory 03.02.05
www.idefense.com/application/poi/display?id=3D215&type=3Dvulnerabilities
March 2, 2005
I. BACKGROUND
The Computer Associates License Client/Server applications provide a=20
method for CA products to register their licenses on the network. The=20
License Client and Server are distributed with almost all CA software=20
distributions. More information about Computer Associates software=20
products is available from:
http://www3.ca.com/Products/
II. DESCRIPTION
Remote exploitation of a buffer overflow vulnerability in Computer=20
Associates License Server and License Client can allow attackers to=20
execute arbitrary code.
The vulnerability specifically exists due to insufficient bounds=20
checking on user-supplied values in GCR requests. The GCR request=20
packet format is shown below:
A0 GCR HOSTNAME<DEVBOX>HARDWARE<001122334455>LOCALE<English>
IDENT1<unknown>IDENT2<unknown>IDENT3<unknown>IDENT4<unknown>
OS<Windows_NT 5.0>OLFFILE<0 0 0>SERVER<RMT>VERSION<3 1.54.0>
NETWORK<127.0.0.1 HOSTNAME 255.255.255.0>MACHINE<PC_1586_1_3201>
CHECKSUMS<1 2 3 4 5 6 7 8 9 10 11 12>RMTV<1.00><EOM>
If the second, fifth, eighth, or eleventh field of the Checksums item=20
contains a large string, a stack overflow will occur. The format=20
specifier for the call to sscanf() is simply:
"%x %s %i %x %s %i %x %s %i %x %s %i"
If the eleventh field is used to overflow the local stack buffer, the=20
return address will be overwritten with the address at 64 bytes into=20
the overflow string.
Ollydbg output after SEH overwrite in CA License Client:
EAX 00630510
ECX 7C91056D ntdll.7C91056D
EDX 003B0000
EBX 00D4E053 ASCII "GCR"
ESP 0082FC10 ASCII "XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
EBP 00D4E050 ASCII "A0"
ESI 0082FCBC ASCII "XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
EDI 00D4E057 ASCII "HOSTNAME<DEVBOX>HARDWARE<0011
EIP DEADC0DE
Log data, item 0
Address=3DDEADC0DE
Message=3DAccess violation when executing [DEADC0DE]
III. ANALYSIS
Exploitation allows remote attackers to execute arbitrary code under=20
the privileges of Local System. A GETCONFIG packet exchange which=20
discloses the remote operating system version usually proceeds the GCR=20
request and increases the likelihood of successful exploitation. The CA=20
License Server does not run by default, but is packaged with most=20
Computer Associates software distributions. The CA License Client does=20
run by default and is packaged with almost all Computer Associates=20
software.
IV. DETECTION
iDEFENSE has confirmed that CA License Server 0.1.0.15 and CA License=20
Client 0.1.0.15 are vulnerable.=20
V. WORKAROUND
Use a firewall to only allow trusted hosts to connect to the Computer=20
Associates License Server and Client ports.=20
VI. VENDOR RESPONSE
A vendor advisory for this issue is available at:
http://supportconnectw.ca.com/public/ca_common_docs/security_notice.asp
Patches for this issue are available at:
http://supportconnectw.ca.com/public/reglic/downloads/licensepatch.asp#a
lp
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-0581 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems. This is one of several overflows that have been
assigned CAN-2005-0581.
VIII. DISCLOSURE TIMELINE
12/01/2004 Initial vendor notification
12/01/2004 Initial vendor response
03/02/2005 Coordinated public disclosure
IX. CREDIT
An anonymous contributor is credited with discovering this=20
vulnerability.
Get paid for vulnerability research=20
http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events
http://labs.idefense.com
X. LEGAL NOTICES
Copyright (c) 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert=20
electronically. It may not be edited in any way without the express=20
written consent of iDEFENSE. If you wish to reprint the whole or any=20
part of this alert in any other medium other than electronically,=20
please email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate=20
at the time of publishing based on currently available information. Use=20
of the information constitutes acceptance for use in an AS IS=20
condition. There are no warranties with regard to this information.=20
Neither the author nor the publisher accepts any liability for any=20
direct, indirect, or consequential loss or damage arising from use of,=20
or reliance on, this information.
iDEFENSE Security Advisory 03.02.05
www.idefense.com/application/poi/display?id=3D215&type=3Dvulnerabilities
March 2, 2005
I. BACKGROUND
The Computer Associates License Client/Server applications provide a=20
method for CA products to register their licenses on the network. The=20
License Client and Server are distributed with almost all CA software=20
distributions. More information about Computer Associates software=20
products is available from:
http://www3.ca.com/Products/
II. DESCRIPTION
Remote exploitation of a buffer overflow vulnerability in Computer=20
Associates License Server and License Client can allow attackers to=20
execute arbitrary code.
The vulnerability specifically exists due to insufficient bounds=20
checking on user-supplied values in GCR requests. The GCR request=20
packet format is shown below:
A0 GCR HOSTNAME<DEVBOX>HARDWARE<001122334455>LOCALE<English>
IDENT1<unknown>IDENT2<unknown>IDENT3<unknown>IDENT4<unknown>
OS<Windows_NT 5.0>OLFFILE<0 0 0>SERVER<RMT>VERSION<3 1.54.0>
NETWORK<127.0.0.1 HOSTNAME 255.255.255.0>MACHINE<PC_1586_1_3201>
CHECKSUMS<1 2 3 4 5 6 7 8 9 10 11 12>RMTV<1.00><EOM>
If the second, fifth, eighth, or eleventh field of the Checksums item=20
contains a large string, a stack overflow will occur. The format=20
specifier for the call to sscanf() is simply:
"%x %s %i %x %s %i %x %s %i %x %s %i"
If the eleventh field is used to overflow the local stack buffer, the=20
return address will be overwritten with the address at 64 bytes into=20
the overflow string.
Ollydbg output after SEH overwrite in CA License Client:
EAX 00630510
ECX 7C91056D ntdll.7C91056D
EDX 003B0000
EBX 00D4E053 ASCII "GCR"
ESP 0082FC10 ASCII "XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
EBP 00D4E050 ASCII "A0"
ESI 0082FCBC ASCII "XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
EDI 00D4E057 ASCII "HOSTNAME<DEVBOX>HARDWARE<0011
EIP DEADC0DE
Log data, item 0
Address=3DDEADC0DE
Message=3DAccess violation when executing [DEADC0DE]
III. ANALYSIS
Exploitation allows remote attackers to execute arbitrary code under=20
the privileges of Local System. A GETCONFIG packet exchange which=20
discloses the remote operating system version usually proceeds the GCR=20
request and increases the likelihood of successful exploitation. The CA=20
License Server does not run by default, but is packaged with most=20
Computer Associates software distributions. The CA License Client does=20
run by default and is packaged with almost all Computer Associates=20
software.
IV. DETECTION
iDEFENSE has confirmed that CA License Server 0.1.0.15 and CA License=20
Client 0.1.0.15 are vulnerable.=20
V. WORKAROUND
Use a firewall to only allow trusted hosts to connect to the Computer=20
Associates License Server and Client ports.=20
VI. VENDOR RESPONSE
A vendor advisory for this issue is available at:
http://supportconnectw.ca.com/public/ca_common_docs/security_notice.asp
Patches for this issue are available at:
http://supportconnectw.ca.com/public/reglic/downloads/licensepatch.asp#a
lp
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-0581 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems. This is one of several overflows that have been
assigned CAN-2005-0581.
VIII. DISCLOSURE TIMELINE
12/01/2004 Initial vendor notification
12/01/2004 Initial vendor response
03/02/2005 Coordinated public disclosure
IX. CREDIT
An anonymous contributor is credited with discovering this=20
vulnerability.
Get paid for vulnerability research=20
http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events
http://labs.idefense.com
X. LEGAL NOTICES
Copyright (c) 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert=20
electronically. It may not be edited in any way without the express=20
written consent of iDEFENSE. If you wish to reprint the whole or any=20
part of this alert in any other medium other than electronically,=20
please email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate=20
at the time of publishing based on currently available information. Use=20
of the information constitutes acceptance for use in an AS IS=20
condition. There are no warranties with regard to this information.=20
Neither the author nor the publisher accepts any liability for any=20
direct, indirect, or consequential loss or damage arising from use of,=20
or reliance on, this information.