Computer Associates License Client/Server GETCONFIG Buffer Overflow=20

iDEFENSE Security Advisory 03.02.05
http://www.idefense.com/application/...ulnerabilities
March 2, 2005

I. BACKGROUND

The Computer Associates License Client/Server applications provide a=20
method for CA products to register their licenses on the network. The=20
License Client and Server are distributed with almost all CA software=20
distributions. More information about Computer Associates software=20
products is available from:

http://www3.ca.com/Products/

II. DESCRIPTION

Remote exploitation of a buffer overflow vulnerability in Computer=20
Associates License Server and License Client can allow attackers to=20
execute arbitrary code.

The vulnerability specifically exists due to insufficient bounds=20
checking on user-supplied values in GETCONFIG requests. Under normal=20
operation, the License Server will send a GETCONFIG request to=20
connecting clients and clients may optionally respond with a similar=20
GETCONFIG packet. Both the client and server software fail to check=20
bounds on the last parameter of the GETCONFIG packet which results in a=20
stack overflow as shown below.=20

Ollydbg output after SEH overwrite in CA License Server:

EAX 00000001
ECX 7C90FB71 ntdll.7C90FB71
EDX 0000000D
EBX 00E4E053 ASCII "GETCONFIG"
ESP 00E2FC9C
EBP 00E4E050 ASCII "A0"
ESI 00E2FD18
EDI 00E4E05D ASCII "SELF"
EIP DEADC0DE

Log data, item 0
Address=3DDEADC0DE
Message=3DAccess violation when executing [DEADC0DE]

III. ANALYSIS

Exploitation allows remote attackers to execute arbitrary code under=20
the privileges of Local System. The GETCONFIG packet also contains the=20
remote operating system's version information, which increases the=20
likelihood of successful exploitation. The CA License Server does not=20
run by default, but is packaged with most Computer Associates software=20
distributions. The CA License Client does run by default and is=20
packaged with almost all Computer Associates software.

IV. DETECTION

iDEFENSE has confirmed that CA License Server 0.1.0.15 and CA License=20
Client 0.1.0.15 are vulnerable.=20

V. WORKAROUND

Use a firewall to only allow trusted hosts to connect to the Computer=20
Associates License Server and Client ports.=20

VI. VENDOR RESPONSE

A vendor advisory for this issue is available at:

http://supportconnectw.ca.com/public...ity_notice.asp

Patches for this issue are available at:

http://supportconnectw.ca.com/public...nsepatch.asp#a
lp

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-0581 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems. This is one of several overflows that have been
assigned CAN-2005-0581.

VIII. DISCLOSURE TIMELINE

12/01/2004 Initial vendor notification
12/01/2004 Initial vendor response
03/02/2005 Coordinated public disclosure

IX. CREDIT

An anonymous contributor is credited with discovering this=20
vulnerability.

Get paid for vulnerability research=20
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Copyright (c) 2005 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert=20
electronically. It may not be edited in any way without the express=20
written consent of iDEFENSE. If you wish to reprint the whole or any=20
part of this alert in any other medium other than electronically,=20
please email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate=20
at the time of publishing based on currently available information. Use=20
of the information constitutes acceptance for use in an AS IS=20
condition. There are no warranties with regard to this information.=20
Neither the author nor the publisher accepts any liability for any=20
direct, indirect, or consequential loss or damage arising from use of,=20
or reliance on, this information.