Likes: 
CAID 32896 - Computer Associates Vet Antivirus engine heap overflow=20
vulnerability
CA Vulnerability ID: 32896
Discovery Date: 2005/04/26
Discovered By: Alex Wheeler
Title:
Computer Associates Vet Antivirus engine heap overflow vulnerability
Impact:
Remote attackers can gain privileged access.
=20
Summary:
Computer Associates has patched a high risk vulnerability that was=20
identified by Alex Wheeler. The vulnerability affects computers=20
leveraging our eTrust(TM) Vet Antivirus engine, and can allow an=20
attacker to gain control of a computer through a specially crafted=20
Microsoft Office document.
Severity:
Computer Associates has given this vulnerability a High risk rating. =20
The Vet Antivirus Engine is included in drivers, system services to=20
automatically scan any files that the computer may access. These=20
software components have privileged access to the local computer and=20
are started by default by our Antivirus software installation. In=20
the worst case scenario, a remote attacker may present a specially=20
crafted Microsoft Office document to a vulnerable computer for virus=20
scanning and gain control of the computer without any user=20
interaction.
Affected corporate products:
CA InoculateIT 6.0 (all platforms, including Notes/Exchange)
eTrust Antivirus r6.0 (all platforms, including Notes/Exchange)
eTrust Antivirus r7.0 (all platforms, including Notes/Exchange)
eTrust Antivirus r7.1 (all platforms, including Notes/Exchange)
eTrust Antivirus for the Gateway r7.0 (all modules and platforms)
eTrust Antivirus for the Gateway r7.1 (all modules and platforms)
eTrust Secure Content Manager (all releases)
eTrust Intrusion Detection (all releases)
BrightStor ARCserve Backup (BAB) r11.1 Windows
Affected retail products:
eTrust EZ Antivirus r6.2 - r7.0.5
eTrust EZ Armor r1.0 - r2.4.4
eTrust EZ Armor LE r2.0 - r3.0.0.14
Vet Antivirus r10.66 and below
Status:
All Computer Associates corporate products and some of our retail=20
products that utilize the Vet Antivirus Engine have the ability to=20
patch this vulnerability automatically. For these products, the=20
patch for this vulnerability was already rolled out as part of the=20
daily Vet Signature updates on May 3, 2005, and no further action=20
is required. =20
Recommendation:
To make sure your system is protected, please review the solutions=20
below for your specific product version.
* All corporate products - You are protected if you are running=20
Vet engine 11.9.1 or later. If running an earlier version,=20
perform a virus signature file update as soon as possible to=20
receive the patch.
* eTrust EZ Antivirus r7/eTrust EZ Armor r3.1 Users - You may=20
already be up-to-date. A new Vet engine was made available on=20
Tuesday, May 3rd. Automatic signature file updates should have=20
downloaded this update to your system. To verify the update,=20
please follow the instructions below:
Open eTrust EZ Antivirus (double-click on the "AV" icon in your=20
system tray), then select the "Help" tab on the top-right of the=20
screen. The engine version should be listed as 11.9.1 or later.
If it is a lower number, perform a virus signature file update [1]
immediately to receive the patch.
* eTrust EZ Antivirus r6.x Users - Upgrade to eTrust EZ Antivirus r7
as soon as possible. It takes approximately 10 minutes to=20
complete this process on a high-speed connection, and all users=20
with an active license are entitled to this upgrade for free. =20
Follow the link below to upgrade now.
http://consumerdownloads.ca.com/myeT...ZAntivirus.exe
- For additional upgrade instructions, click on the appropriate=20
link below:
- Upgrading from r6.1 and above [2]
- Upgrading from r6.0 and earlier [3]
Unsure of your product version? Follow the link in footnote [4].
* eTrust EZ Armor r3 Users - An update will be pushed down to your=20
computer. During a virus signature file update, a patch will be=20
downloaded to your computer. The patch will require that you=20
reboot your computer for it to take effect. We recommend that=20
you reboot right away.
=20
* eTrust EZ Armor r2.4.4 and below Users - Upgrade to eTrust EZ=20
Armor r3.1 as soon as possible. It takes approximately 10=20
minutes to complete this process on a high-speed connection and=20
all users with an active license are entitled to this upgrade for=20
free. Follow the link below to upgrade now.
http://consumerdownloads.ca.com/myeT...ps/EZArmor.exe
Unsure of your product version? Follow the link in footnote [4].
CVE Reference: Pending
OSVDB Reference: Pending
Advisory URLs (note that URLs below may wrap):
General:
http://www3.ca.com/securityadvisor/v...spx?id=3D32896
Consumer:
http://crm.my-etrust.com/login.asp?u...DDOCUMENT&ope=
npa
rameter=3D1588
[1]
http://crm.my-etrust.com/login.asp?u...DDOCUMENT&ope=
npa
rameter=3D61
[2]
http://crm.my-etrust.com/login.asp?u...DDOCUMENT&ope=
npa
rameter=3D1907
[3]
http://crm.my-etrust.com/login.asp?u...DDOCUMENT&ope=
npa
rameter=3D1911
[4]
http://crm.my-etrust.com/login.asp?u...DDOCUMENT&ope=
npa
rameter=3D89
Should you require additional information, please contact CA=20
Technical Support at http://supportconnect.ca.com.
Respectfully,
Ken Williams ; Vulnerability Research=20
A9F9 44A6 B421 FF7D 4000 E6A9 7925 91DF E294 1985
Computer Associates International, Inc. (CA).=20
One Computer Associates Plaza. Islandia, NY 11749
=09
Contact Us http://ca.com/catalk.htm
Legal Notice http://ca.com/calegal.htm
Privacy Policy http://ca.com
Copyright 2005 Computer Associates International, Inc.
All rights reserved
Quote
