iDEFENSE Labs
02/03/05, 20:05
Computer Associates License Client/Server GCR Network Buffer Overflow=20
iDEFENSE Security Advisory 03.02.05
www.idefense.com/application/poi/display?id=3D214&type=3Dvulnerabilities
March 2, 2005
I. BACKGROUND
The Computer Associates License Client/Server applications provide a=20
method for CA products to register their licenses on the network. The=20
License Client and Server are distributed with almost all CA software=20
distributions. More information about Computer Associates software=20
products is available from:
http://www3.ca.com/Products/
II. DESCRIPTION
Remote exploitation of a buffer overflow vulnerability in Computer=20
Associates License Server and License Client can allow attackers to=20
execute arbitrary code.
The vulnerability specifically exists due to insufficient bounds=20
checking on user-supplied values in GCR requests. The GCR request=20
packet format is shown below:
A0 GCR HOSTNAME<DEVBOX>HARDWARE<001122334455>LOCALE<English>=20
IDENT1<unknown>IDENT2<unknown>IDENT3<unknown>IDENT4<unknown>=20
OS<Windows_NT 5.0>OLFFILE<0 0 0>SERVER<RMT>VERSION<3 1.54.0>=20
NETWORK<127.0.0.1 HOSTNAME 255.255.255.0>MACHINE<PC_1586_1_3201>=20
CHECKSUMS<1 2 3 4 5 6 7 8 9 10 11 12>RMTV<1.00><EOM>
If the IP address, hostname, or netmask contain large values, the stack=20
overflow can be triggered.
Ollydbg output after SEH overwrite in CA License Server:
EAX 00630210=20
ECX 7C91056D ntdll.7C91056D=20
EDX 003B0608=20
EBX 00E4E053 ASCII "GCR"=20
ESP 00E2FC7C ASCII "XXXXXXXXXXXXXXXXXXXXXXXXXXXXX=20
EBP 00E4E050 ASCII "A0"=20
ESI 00E2FD28 ASCII "XXXXXXXXXXXXXXXXXXXXXXXXXXXXX=20
EDI 00E4E057 ASCII "HOSTNAME<DEVBOX>HARDWARE<0011=20
EIP DEADC0DE
SEH chain of thread 00000DA4, item 0=20
Address=3D00E2FFA4=20
SE handler=3D58585858
Log data, item 0=20
Address=3DDEADC0DE=20
Message=3DAccess violation when executing [DEADC0DE]
III. ANALYSIS
Exploitation allows remote attackers to execute arbitrary code under=20
the privileges of Local System. A GETCONFIG packet exchange which=20
discloses the remote operating system version usually proceeds the GCR=20
request and increases the likelihood of successful exploitation. The CA=20
License Server does not run by default, but is packaged with most=20
Computer Associates software distributions. The CA License Client does=20
run by default and is packaged with almost all Computer Associates=20
software.
IV. DETECTION
iDEFENSE has confirmed that CA License Server 0.1.0.15 and CA License=20
Client 0.1.0.15 are vulnerable.=20
V. WORKAROUND
Use a firewall to only allow trusted hosts to connect to the Computer=20
Associates License Server and Client ports.=20
VI. VENDOR RESPONSE
A vendor advisory for this issue is available at:
http://supportconnectw.ca.com/public/ca_common_docs/security_notice.asp
Patches for this issue are available at:
http://supportconnectw.ca.com/public/reglic/downloads/licensepatch.asp#a
lp
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-0581 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems. This is one of several overflows that have been
assigned CAN-2005-0581.
VIII. DISCLOSURE TIMELINE
12/01/2004 Initial vendor notification
12/01/2004 Initial vendor response
03/02/2005 Coordinated public disclosure
IX. CREDIT
An anonymous contributor is credited with discovering this=20
vulnerability.
Get paid for vulnerability research=20
http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events
http://labs.idefense.com
X. LEGAL NOTICES
Copyright (c) 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert=20
electronically. It may not be edited in any way without the express=20
written consent of iDEFENSE. If you wish to reprint the whole or any=20
part of this alert in any other medium other than electronically,=20
please email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate=20
at the time of publishing based on currently available information. Use=20
of the information constitutes acceptance for use in an AS IS=20
condition. There are no warranties with regard to this information.=20
Neither the author nor the publisher accepts any liability for any=20
direct, indirect, or consequential loss or damage arising from use of,=20
or reliance on, this information.
iDEFENSE Security Advisory 03.02.05
www.idefense.com/application/poi/display?id=3D214&type=3Dvulnerabilities
March 2, 2005
I. BACKGROUND
The Computer Associates License Client/Server applications provide a=20
method for CA products to register their licenses on the network. The=20
License Client and Server are distributed with almost all CA software=20
distributions. More information about Computer Associates software=20
products is available from:
http://www3.ca.com/Products/
II. DESCRIPTION
Remote exploitation of a buffer overflow vulnerability in Computer=20
Associates License Server and License Client can allow attackers to=20
execute arbitrary code.
The vulnerability specifically exists due to insufficient bounds=20
checking on user-supplied values in GCR requests. The GCR request=20
packet format is shown below:
A0 GCR HOSTNAME<DEVBOX>HARDWARE<001122334455>LOCALE<English>=20
IDENT1<unknown>IDENT2<unknown>IDENT3<unknown>IDENT4<unknown>=20
OS<Windows_NT 5.0>OLFFILE<0 0 0>SERVER<RMT>VERSION<3 1.54.0>=20
NETWORK<127.0.0.1 HOSTNAME 255.255.255.0>MACHINE<PC_1586_1_3201>=20
CHECKSUMS<1 2 3 4 5 6 7 8 9 10 11 12>RMTV<1.00><EOM>
If the IP address, hostname, or netmask contain large values, the stack=20
overflow can be triggered.
Ollydbg output after SEH overwrite in CA License Server:
EAX 00630210=20
ECX 7C91056D ntdll.7C91056D=20
EDX 003B0608=20
EBX 00E4E053 ASCII "GCR"=20
ESP 00E2FC7C ASCII "XXXXXXXXXXXXXXXXXXXXXXXXXXXXX=20
EBP 00E4E050 ASCII "A0"=20
ESI 00E2FD28 ASCII "XXXXXXXXXXXXXXXXXXXXXXXXXXXXX=20
EDI 00E4E057 ASCII "HOSTNAME<DEVBOX>HARDWARE<0011=20
EIP DEADC0DE
SEH chain of thread 00000DA4, item 0=20
Address=3D00E2FFA4=20
SE handler=3D58585858
Log data, item 0=20
Address=3DDEADC0DE=20
Message=3DAccess violation when executing [DEADC0DE]
III. ANALYSIS
Exploitation allows remote attackers to execute arbitrary code under=20
the privileges of Local System. A GETCONFIG packet exchange which=20
discloses the remote operating system version usually proceeds the GCR=20
request and increases the likelihood of successful exploitation. The CA=20
License Server does not run by default, but is packaged with most=20
Computer Associates software distributions. The CA License Client does=20
run by default and is packaged with almost all Computer Associates=20
software.
IV. DETECTION
iDEFENSE has confirmed that CA License Server 0.1.0.15 and CA License=20
Client 0.1.0.15 are vulnerable.=20
V. WORKAROUND
Use a firewall to only allow trusted hosts to connect to the Computer=20
Associates License Server and Client ports.=20
VI. VENDOR RESPONSE
A vendor advisory for this issue is available at:
http://supportconnectw.ca.com/public/ca_common_docs/security_notice.asp
Patches for this issue are available at:
http://supportconnectw.ca.com/public/reglic/downloads/licensepatch.asp#a
lp
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-0581 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems. This is one of several overflows that have been
assigned CAN-2005-0581.
VIII. DISCLOSURE TIMELINE
12/01/2004 Initial vendor notification
12/01/2004 Initial vendor response
03/02/2005 Coordinated public disclosure
IX. CREDIT
An anonymous contributor is credited with discovering this=20
vulnerability.
Get paid for vulnerability research=20
http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events
http://labs.idefense.com
X. LEGAL NOTICES
Copyright (c) 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert=20
electronically. It may not be edited in any way without the express=20
written consent of iDEFENSE. If you wish to reprint the whole or any=20
part of this alert in any other medium other than electronically,=20
please email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate=20
at the time of publishing based on currently available information. Use=20
of the information constitutes acceptance for use in an AS IS=20
condition. There are no warranties with regard to this information.=20
Neither the author nor the publisher accepts any liability for any=20
direct, indirect, or consequential loss or damage arising from use of,=20
or reliance on, this information.