list@rem0te.com
23/05/05, 18:35
Date
May 23, 2005
Vulnerability
Computer Associates Vet library provides antivirus scan engine capabiliti=
es. Vet scan engines allow products to analyze various streams for malwar=
e. Vet is vulnerable to an integer wrap during the analysis of an OLE str=
eam. The integer wrap causes an arbitrary heap overflow with no character=
restrictions allowing remote attackers control of the system(s) Vet is p=
rotecting.
Specifically, within decompressed VBA directories project name records ha=
ve a 32 bit length value which is incremented for a null byte. It is then=
used as an allocation length. Given a project name length of -1 Vet incr=
ements it and calls new(0), which allocates a small chunk. The small chun=
k is used for the destination of a copy with a negative length. The negat=
ive length is discarded for an attacker controlled length below 4096 befo=
re the copy.
Impact
Successful exploitation of protected systems allows attackers unauthorize=
d control of data and privileges. It also provides leverage for further n=
etwork compromise. This vulnerability can be exploited remotely through c=
ommon protocols, such as SMTP, FTP, SMB, etc. It can be triggered without=
authentication or user interaction and allows multiple exploitation atte=
mpts. Vet implementations are likely vulnerable in their default configur=
ation.
Affected Products
CA InoculateIT 6.0 (all platforms including Notes/Exchange
CA eTrust Antivirus r6.0 all platforms including Notes/Exchange
CA eTrust Antivirus r7.0 all platforms including Notes/Exchange
CA eTrust Antivirus r7.1 all platforms including Notes/Exchange
CA eTrust Antivirus for the Gateway r7.0 all modules and platforms
CA eTrust Antivirus for the Gateway r7.1 all modules and platforms
CA eTrust Secure Content Manager all releases
CA eTrust Intrusion Detection all releases
CA BrightStor ARCserve Backup (BAB) r11.1 Windows
CA Vet Antivirus
Zonelabs ZoneAlarm Security Suite
Zonelabs ZoneAlarm Antivirus
Note: There are also several other vendors, including large ISP=E2=80=99s=
that OEM the Vet library. Refer to vendor for version specifics.
Credit
This vulnerability was discovered and researched by Alex Wheeler.
Contact
security@rem0te.com
Full Advisory
http://www.rem0te.com/public/images/vet.pdf
May 23, 2005
Vulnerability
Computer Associates Vet library provides antivirus scan engine capabiliti=
es. Vet scan engines allow products to analyze various streams for malwar=
e. Vet is vulnerable to an integer wrap during the analysis of an OLE str=
eam. The integer wrap causes an arbitrary heap overflow with no character=
restrictions allowing remote attackers control of the system(s) Vet is p=
rotecting.
Specifically, within decompressed VBA directories project name records ha=
ve a 32 bit length value which is incremented for a null byte. It is then=
used as an allocation length. Given a project name length of -1 Vet incr=
ements it and calls new(0), which allocates a small chunk. The small chun=
k is used for the destination of a copy with a negative length. The negat=
ive length is discarded for an attacker controlled length below 4096 befo=
re the copy.
Impact
Successful exploitation of protected systems allows attackers unauthorize=
d control of data and privileges. It also provides leverage for further n=
etwork compromise. This vulnerability can be exploited remotely through c=
ommon protocols, such as SMTP, FTP, SMB, etc. It can be triggered without=
authentication or user interaction and allows multiple exploitation atte=
mpts. Vet implementations are likely vulnerable in their default configur=
ation.
Affected Products
CA InoculateIT 6.0 (all platforms including Notes/Exchange
CA eTrust Antivirus r6.0 all platforms including Notes/Exchange
CA eTrust Antivirus r7.0 all platforms including Notes/Exchange
CA eTrust Antivirus r7.1 all platforms including Notes/Exchange
CA eTrust Antivirus for the Gateway r7.0 all modules and platforms
CA eTrust Antivirus for the Gateway r7.1 all modules and platforms
CA eTrust Secure Content Manager all releases
CA eTrust Intrusion Detection all releases
CA BrightStor ARCserve Backup (BAB) r11.1 Windows
CA Vet Antivirus
Zonelabs ZoneAlarm Security Suite
Zonelabs ZoneAlarm Antivirus
Note: There are also several other vendors, including large ISP=E2=80=99s=
that OEM the Vet library. Refer to vendor for version specifics.
Credit
This vulnerability was discovered and researched by Alex Wheeler.
Contact
security@rem0te.com
Full Advisory
http://www.rem0te.com/public/images/vet.pdf