Computer Associates License Client/Server GCR Checksum Buffer Overflow=20

iDEFENSE Security Advisory 03.02.05
http://www.idefense.com/application/...ulnerabilities
March 2, 2005

I. BACKGROUND

The Computer Associates License Client/Server applications provide a=20
method for CA products to register their licenses on the network. The=20
License Client and Server are distributed with almost all CA software=20
distributions. More information about Computer Associates software=20
products is available from:

http://www3.ca.com/Products/

II. DESCRIPTION

Remote exploitation of a buffer overflow vulnerability in Computer=20
Associates License Server and License Client can allow attackers to=20
execute arbitrary code.

The vulnerability specifically exists due to insufficient bounds=20
checking on user-supplied values in GCR requests. The GCR request=20
packet format is shown below:

A0 GCR HOSTNAME<DEVBOX>HARDWARE<001122334455>LOCALE<Engli sh>
IDENT1<unknown>IDENT2<unknown>IDENT3<unknown>IDENT 4<unknown>
OS<Windows_NT 5.0>OLFFILE<0 0 0>SERVER<RMT>VERSION<3 1.54.0>
NETWORK<127.0.0.1 HOSTNAME 255.255.255.0>MACHINE<PC_1586_1_3201>
CHECKSUMS<1 2 3 4 5 6 7 8 9 10 11 12>RMTV<1.00><EOM>

If the second, fifth, eighth, or eleventh field of the Checksums item=20
contains a large string, a stack overflow will occur. The format=20
specifier for the call to sscanf() is simply:

"%x %s %i %x %s %i %x %s %i %x %s %i"

If the eleventh field is used to overflow the local stack buffer, the=20
return address will be overwritten with the address at 64 bytes into=20
the overflow string.

Ollydbg output after SEH overwrite in CA License Client:

EAX 00630510
ECX 7C91056D ntdll.7C91056D
EDX 003B0000
EBX 00D4E053 ASCII "GCR"
ESP 0082FC10 ASCII "XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
EBP 00D4E050 ASCII "A0"
ESI 0082FCBC ASCII "XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
EDI 00D4E057 ASCII "HOSTNAME<DEVBOX>HARDWARE<0011
EIP DEADC0DE

Log data, item 0
Address=3DDEADC0DE
Message=3DAccess violation when executing [DEADC0DE]

III. ANALYSIS

Exploitation allows remote attackers to execute arbitrary code under=20
the privileges of Local System. A GETCONFIG packet exchange which=20
discloses the remote operating system version usually proceeds the GCR=20
request and increases the likelihood of successful exploitation. The CA=20
License Server does not run by default, but is packaged with most=20
Computer Associates software distributions. The CA License Client does=20
run by default and is packaged with almost all Computer Associates=20
software.

IV. DETECTION

iDEFENSE has confirmed that CA License Server 0.1.0.15 and CA License=20
Client 0.1.0.15 are vulnerable.=20

V. WORKAROUND

Use a firewall to only allow trusted hosts to connect to the Computer=20
Associates License Server and Client ports.=20

VI. VENDOR RESPONSE

A vendor advisory for this issue is available at:

http://supportconnectw.ca.com/public...ity_notice.asp

Patches for this issue are available at:

http://supportconnectw.ca.com/public...nsepatch.asp#a
lp

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-0581 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems. This is one of several overflows that have been
assigned CAN-2005-0581.

VIII. DISCLOSURE TIMELINE

12/01/2004 Initial vendor notification
12/01/2004 Initial vendor response
03/02/2005 Coordinated public disclosure

IX. CREDIT

An anonymous contributor is credited with discovering this=20
vulnerability.

Get paid for vulnerability research=20
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Copyright (c) 2005 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert=20
electronically. It may not be edited in any way without the express=20
written consent of iDEFENSE. If you wish to reprint the whole or any=20
part of this alert in any other medium other than electronically,=20
please email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate=20
at the time of publishing based on currently available information. Use=20
of the information constitutes acceptance for use in an AS IS=20
condition. There are no warranties with regard to this information.=20
Neither the author nor the publisher accepts any liability for any=20
direct, indirect, or consequential loss or damage arising from use of,=20
or reliance on, this information.