iDEFENSE Labs
02/03/05, 20:15
Computer Associates License Client/Server GETCONFIG Buffer Overflow=20
iDEFENSE Security Advisory 03.02.05
www.idefense.com/application/poi/display?id=3D213&type=3Dvulnerabilities
March 2, 2005
I. BACKGROUND
The Computer Associates License Client/Server applications provide a=20
method for CA products to register their licenses on the network. The=20
License Client and Server are distributed with almost all CA software=20
distributions. More information about Computer Associates software=20
products is available from:
http://www3.ca.com/Products/
II. DESCRIPTION
Remote exploitation of a buffer overflow vulnerability in Computer=20
Associates License Server and License Client can allow attackers to=20
execute arbitrary code.
The vulnerability specifically exists due to insufficient bounds=20
checking on user-supplied values in GETCONFIG requests. Under normal=20
operation, the License Server will send a GETCONFIG request to=20
connecting clients and clients may optionally respond with a similar=20
GETCONFIG packet. Both the client and server software fail to check=20
bounds on the last parameter of the GETCONFIG packet which results in a=20
stack overflow as shown below.=20
Ollydbg output after SEH overwrite in CA License Server:
EAX 00000001
ECX 7C90FB71 ntdll.7C90FB71
EDX 0000000D
EBX 00E4E053 ASCII "GETCONFIG"
ESP 00E2FC9C
EBP 00E4E050 ASCII "A0"
ESI 00E2FD18
EDI 00E4E05D ASCII "SELF"
EIP DEADC0DE
Log data, item 0
Address=3DDEADC0DE
Message=3DAccess violation when executing [DEADC0DE]
III. ANALYSIS
Exploitation allows remote attackers to execute arbitrary code under=20
the privileges of Local System. The GETCONFIG packet also contains the=20
remote operating system's version information, which increases the=20
likelihood of successful exploitation. The CA License Server does not=20
run by default, but is packaged with most Computer Associates software=20
distributions. The CA License Client does run by default and is=20
packaged with almost all Computer Associates software.
IV. DETECTION
iDEFENSE has confirmed that CA License Server 0.1.0.15 and CA License=20
Client 0.1.0.15 are vulnerable.=20
V. WORKAROUND
Use a firewall to only allow trusted hosts to connect to the Computer=20
Associates License Server and Client ports.=20
VI. VENDOR RESPONSE
A vendor advisory for this issue is available at:
http://supportconnectw.ca.com/public/ca_common_docs/security_notice.asp
Patches for this issue are available at:
http://supportconnectw.ca.com/public/reglic/downloads/licensepatch.asp#a
lp
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-0581 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems. This is one of several overflows that have been
assigned CAN-2005-0581.
VIII. DISCLOSURE TIMELINE
12/01/2004 Initial vendor notification
12/01/2004 Initial vendor response
03/02/2005 Coordinated public disclosure
IX. CREDIT
An anonymous contributor is credited with discovering this=20
vulnerability.
Get paid for vulnerability research=20
http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events
http://labs.idefense.com
X. LEGAL NOTICES
Copyright (c) 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert=20
electronically. It may not be edited in any way without the express=20
written consent of iDEFENSE. If you wish to reprint the whole or any=20
part of this alert in any other medium other than electronically,=20
please email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate=20
at the time of publishing based on currently available information. Use=20
of the information constitutes acceptance for use in an AS IS=20
condition. There are no warranties with regard to this information.=20
Neither the author nor the publisher accepts any liability for any=20
direct, indirect, or consequential loss or damage arising from use of,=20
or reliance on, this information.
iDEFENSE Security Advisory 03.02.05
www.idefense.com/application/poi/display?id=3D213&type=3Dvulnerabilities
March 2, 2005
I. BACKGROUND
The Computer Associates License Client/Server applications provide a=20
method for CA products to register their licenses on the network. The=20
License Client and Server are distributed with almost all CA software=20
distributions. More information about Computer Associates software=20
products is available from:
http://www3.ca.com/Products/
II. DESCRIPTION
Remote exploitation of a buffer overflow vulnerability in Computer=20
Associates License Server and License Client can allow attackers to=20
execute arbitrary code.
The vulnerability specifically exists due to insufficient bounds=20
checking on user-supplied values in GETCONFIG requests. Under normal=20
operation, the License Server will send a GETCONFIG request to=20
connecting clients and clients may optionally respond with a similar=20
GETCONFIG packet. Both the client and server software fail to check=20
bounds on the last parameter of the GETCONFIG packet which results in a=20
stack overflow as shown below.=20
Ollydbg output after SEH overwrite in CA License Server:
EAX 00000001
ECX 7C90FB71 ntdll.7C90FB71
EDX 0000000D
EBX 00E4E053 ASCII "GETCONFIG"
ESP 00E2FC9C
EBP 00E4E050 ASCII "A0"
ESI 00E2FD18
EDI 00E4E05D ASCII "SELF"
EIP DEADC0DE
Log data, item 0
Address=3DDEADC0DE
Message=3DAccess violation when executing [DEADC0DE]
III. ANALYSIS
Exploitation allows remote attackers to execute arbitrary code under=20
the privileges of Local System. The GETCONFIG packet also contains the=20
remote operating system's version information, which increases the=20
likelihood of successful exploitation. The CA License Server does not=20
run by default, but is packaged with most Computer Associates software=20
distributions. The CA License Client does run by default and is=20
packaged with almost all Computer Associates software.
IV. DETECTION
iDEFENSE has confirmed that CA License Server 0.1.0.15 and CA License=20
Client 0.1.0.15 are vulnerable.=20
V. WORKAROUND
Use a firewall to only allow trusted hosts to connect to the Computer=20
Associates License Server and Client ports.=20
VI. VENDOR RESPONSE
A vendor advisory for this issue is available at:
http://supportconnectw.ca.com/public/ca_common_docs/security_notice.asp
Patches for this issue are available at:
http://supportconnectw.ca.com/public/reglic/downloads/licensepatch.asp#a
lp
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-0581 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems. This is one of several overflows that have been
assigned CAN-2005-0581.
VIII. DISCLOSURE TIMELINE
12/01/2004 Initial vendor notification
12/01/2004 Initial vendor response
03/02/2005 Coordinated public disclosure
IX. CREDIT
An anonymous contributor is credited with discovering this=20
vulnerability.
Get paid for vulnerability research=20
http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events
http://labs.idefense.com
X. LEGAL NOTICES
Copyright (c) 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert=20
electronically. It may not be edited in any way without the express=20
written consent of iDEFENSE. If you wish to reprint the whole or any=20
part of this alert in any other medium other than electronically,=20
please email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate=20
at the time of publishing based on currently available information. Use=20
of the information constitutes acceptance for use in an AS IS=20
condition. There are no warranties with regard to this information.=20
Neither the author nor the publisher accepts any liability for any=20
direct, indirect, or consequential loss or damage arising from use of,=20
or reliance on, this information.