CAID 33485 - Computer Associates iGateway debug mode HTTP GET request buffer overflow vulnerability

[Williams, James K]

Title: Computer Associates iGateway debug mode HTTP GET request=20
buffer overflow vulnerability

CA Vulnerability ID: 33485

Discovery Date: 2005-10-06

CA Advisory Date: 2005-10-14

Discovered By: EMendoza


Impact: Remote attacker can execute arbitrary code with SYSTEM=20
privileges.


Summary: The Computer Associates iGateway common component, which
is included with several CA products for UNIX/Linux/Windows=20
platforms, contains a buffer overflow vulnerability that could=20
allow remote attackers to execute arbitrary code on Windows=20
platforms, or cause iGateway component failure (denial of=20
service) on UNIX and Linux. The vulnerability is due to improper
bounds checking on HTTP GET requests by the iGateway component=20
when debug mode is enabled.


Mitigating Factors: The potential for exploitation of this=20
vulnerability is very low for the following reasons.

1) A non-standard install of the iGateway component is required=20
to expose this vulnerability. Typically, the embedded iGateway=20
component is part of a non-interactive installation process. =20
Consequently, most systems (those that utilize the default=20
installation procedure) are not at risk.

2) If a non-standard install WAS performed, the iGateway=20
component is still unlikely to be vulnerable to this exploit,=20
because the flaw is only exposed if the component has been=20
manually configured to run with diagnostic debug tracing enabled.
Configuring the component to run in debug mode requires=20
administrative access to configuration files that reside on the=20
machine, and also requires that the iGateway service be stopped=20
and restarted by someone with administrative service privileges.
Configuring the iGateway service to operate in debug mode is=20
typically performed only at the direction of Computer Associates=20
support personnel who are working with a customer to troubleshoot
potential support issues.


Severity: Computer Associates has given this vulnerability a=20
Medium risk rating.


Affected Technologies: Please note that the iGateway component is
not a product, but rather a component that is included with=20
multiple products. The iGateway component is included in the=20
following Computer Associates products, which are consequently=20
potentially vulnerable. Note that iGateway component versions=20
less than 4.0.050615 are vulnerable to this issue.

Business Services Optimization (BSO) Products:
Advantage Data Transformer (ADT) R2.2
Harvest Change Manager R7.1

BrightStor Products:
BrightStor ARCserve Backup r11.5
BrightStor ARCserve Backup r11.1
BrightStor ARCserve Backup for Windows r11
BrightStor Enterprise Backup 10.5
BrightStor ARCserve Backup v9.01
BrightStor ARCserve Backup Laptop & Desktop r11.1
BrightStor ARCserve Backup Laptop & Desktop r11
BrightStor Process Automation Manager r11.1
BrightStor SAN Manager r11.1
BrightStor SAN Manager r11.5
BrightStor Storage Resource Manager r11.5=20
BrightStor Storage Resource Manager r11.1=20
BrightStor Storage Resource Manager 6.4
BrightStor Storage Resource Manager 6.3
BrightStor Portal 11.1

Note to BrightStor Storage Resource Manager and BrightStor Portal
users: In addition to the application servers where these=20
products are installed, all hosts that have iSponsors deployed to
them for managing applications like Veritas Volume Manager and=20
Tivoli TSM are also affected by this vulnerability.

eTrust Products:
eTrust Audit 1.5 SP2 (iRecorders and ARIES)
eTrust Audit 1.5 SP3 (iRecorders and ARIES)
eTrust Audit 8.0 (iRecorders and ARIES)=20
eTrust Admin 8.0
eTrust Admin 8.1
eTrust Identity Minder 8.0
eTrust Secure Content Manager (SCM) R8
eTrust Web Service Security R8
eTrust Integrated Threat Management (ITM) R8

Unicenter Products:=20
Unicenter CA Web Services Distributed Management R11
Unicenter AutoSys JM R11
Unicenter Management for WebLogic / Management for WebSphere R11
Unicenter Service Delivery R11
Unicenter Service Level Management (USLM) R11
Unicenter Application Performance Monitor R11
Unicenter Service Desk R11
Unicenter Service Desk Knowledge Tools R11
Unicenter Service Fulfillment 2.2
Unicenter Service Fulfillment R11
Unicenter Asset Portfolio Management R11
Unicenter Service Matrix Analysis R11
Unicenter Service Catalog/Fulfillment/Accounting R11
Unicetner MQ Management R11
Unicenter Application Server Managmenr R11
Unicenter Web Server Management R11
Unicenter Exchange Management R11=20


Status and Recommendation:=20
As an immediate and completely effective remediation solution,=20
simply do not operate the iGateway component in debug diagnostic=20
trace mode. To ensure that you are not running iGateway in debug=20
mode, look for the "Debug" parameter in your igateway.conf file,=20
and make sure that it is set to "False"=20
(i.e. <Debug>False</Debug>).

We have developed iGateway updates to completely address this=20
vulnerability. After our QA process is completed, the updates=20
will be posted to our SupportConnect web site=20
(http://supportconnect.ca.com). Step-by-step instructions to=20
determine a) if customers are vulnerable, and b) how to remediate
the issue, will be posted to http://supportconnect.ca.com site as=20
well.


Determining your version of iGateway:
To determine the version number of the iGateway component, browse
to the igateway directory and check the version listed in the=20
igateway.conf file.

On windows, this is %IGW_LOC%
Default path for v3.*: C:\Program Files\CA\igateway
Default path for v4.*: C:\Program Files\CA\SharedComponents\iTechnology

On unix,=20
Default path for v3.*: /opt/CA/igateway
Default path for v4.*: the install directory path is contained=20
in opt/CA/SharedComponents/iTechnology location. The default=20
path is /opt/CA/SharedComponents/iTechnology.

Look at the <Version> element in igateway.conf.

The versions are affected by this vulnerability if you see a=20
value LESS THAN the following:=20
<Version>4.0.050615</Version> (note the format of v.s.YYMMDD)


References:=20
CA Security Advisor site
http://www3.ca.com/securityadvisor/v...spx?id=3D33485

CVE Reference: CAN-2005-3190
http://cve.mitre.org/cgi-bin/cvename...DCAN-2005-3190

OSVDB Reference: OSVDB ID 19920=20
http://www.osvdb.org/displayvuln.php?osvdb_id=3D19920


Customers who require additional information should contact CA=20
Technical Support at http://supportconnect.ca.com.

For technical questions or comments related to this advisory,
please send email to vuln@ca.com, or contact me directly.

If you discover a vulnerability in CA products, please report
your findings to vuln@ca.com, or utilize our "Submit a=20
Vulnerability" form.
URL: http://www3.ca.com/securityadvisor/vulninfo/submit.aspx


Respectfully,

Ken Williams ; Dir. Vuln Research=20
Computer Associates ; 0xE2941985


Computer Associates International, Inc. (CA).=20
One Computer Associates Plaza. Islandia, NY 11749
=09
Contact Us http://ca.com/catalk.htm
Legal Notice http://ca.com/calegal.htm
Privacy Policy http://ca.com
Copyright 2005 Computer Associates International, Inc.
All rights reserved

[Williams, James K]

Advisory has been updated to announce availability of iGateway=20
updates for all platforms.


Title: Computer Associates iGateway debug mode HTTP GET request=20
buffer overflow vulnerability (v1.1)

CA Vulnerability ID: 33485

Discovery Date: 2005-10-06

CA Advisory Date v1.0: 2005-10-14 (initial release)
CA Advisory Date v1.1: 2005-10-19 (iGateway updates available)

Discovered By: EMendoza


Impact: Remote attacker can execute arbitrary code with SYSTEM=20
privileges.


Summary: The Computer Associates iGateway common component, which
is included with several CA products for UNIX/Linux/Windows=20
platforms, contains a buffer overflow vulnerability that could=20
allow remote attackers to execute arbitrary code on Windows=20
platforms, or cause iGateway component failure (denial of=20
service) on UNIX and Linux. The vulnerability is due to improper
bounds checking on HTTP GET requests by the iGateway component=20
when debug mode is enabled.


Mitigating Factors: The potential for exploitation of this=20
vulnerability is very low for the following reasons.

1) A non-standard install of the iGateway component is required=20
to expose this vulnerability. Typically, the embedded iGateway=20
component is part of a non-interactive installation process. =20
Consequently, most systems (those that utilize the default=20
installation procedure) are not at risk.

2) If a non-standard install WAS performed, the iGateway=20
component is still unlikely to be vulnerable to this exploit,=20
because the flaw is only exposed if the component has been=20
manually configured to run with diagnostic debug tracing enabled.
Configuring the component to run in debug mode requires=20
administrative access to configuration files that reside on the=20
machine, and also requires that the iGateway service be stopped=20
and restarted by someone with administrative service privileges.
Configuring the iGateway service to operate in debug mode is=20
typically performed only at the direction of Computer Associates=20
support personnel who are working with a customer to troubleshoot
potential support issues.


Severity: Computer Associates has given this vulnerability a=20
Medium risk rating.


Affected Technologies: Please note that the iGateway component is
not a product, but rather a component that is included with=20
multiple products. The iGateway component is included in the=20
following Computer Associates products, which are consequently=20
potentially vulnerable. Note that iGateway component versions=20
less than 4.0.050615 are vulnerable to this issue.

Business Services Optimization (BSO) Products:
Advantage Data Transformer (ADT) R2.2
Harvest Change Manager R7.1

BrightStor Products:
BrightStor ARCserve Backup r11.5
BrightStor ARCserve Backup r11.1
BrightStor ARCserve Backup for Windows r11
BrightStor Enterprise Backup 10.5
BrightStor ARCserve Backup v9.01
BrightStor ARCserve Backup Laptop & Desktop r11.1
BrightStor ARCserve Backup Laptop & Desktop r11
BrightStor Process Automation Manager r11.1
BrightStor SAN Manager r11.1
BrightStor SAN Manager r11.5
BrightStor Storage Resource Manager r11.5=20
BrightStor Storage Resource Manager r11.1=20
BrightStor Storage Resource Manager 6.4
BrightStor Storage Resource Manager 6.3
BrightStor Portal 11.1

Note to BrightStor Storage Resource Manager and BrightStor Portal
users: In addition to the application servers where these=20
products are installed, all hosts that have iSponsors deployed to
them for managing applications like Veritas Volume Manager and=20
Tivoli TSM are also affected by this vulnerability.

eTrust Products:
eTrust Audit 1.5 SP2 (iRecorders and ARIES)
eTrust Audit 1.5 SP3 (iRecorders and ARIES)
eTrust Audit 8.0 (iRecorders and ARIES)=20
eTrust Admin 8.0
eTrust Admin 8.1
eTrust Identity Minder 8.0
eTrust Secure Content Manager (SCM) R8
eTrust Web Service Security R8
eTrust Integrated Threat Management (ITM) R8

Unicenter Products:=20
Unicenter CA Web Services Distributed Management R11
Unicenter AutoSys JM R11
Unicenter Management for WebLogic / Management for WebSphere R11
Unicenter Service Delivery R11
Unicenter Service Level Management (USLM) R11
Unicenter Application Performance Monitor R11
Unicenter Service Desk R11
Unicenter Service Desk Knowledge Tools R11
Unicenter Service Fulfillment 2.2
Unicenter Service Fulfillment R11
Unicenter Asset Portfolio Management R11
Unicenter Service Matrix Analysis R11
Unicenter Service Catalog/Fulfillment/Accounting R11
Unicetner MQ Management R11
Unicenter Application Server Managmenr R11
Unicenter Web Server Management R11
Unicenter Exchange Management R11=20


Status and Recommendation:=20
iGateway updates that address this vulnerability are available
for all affected platforms (Win32, Sun, AIX, HP-UX, Linux).
Download the appropriate update(s), dated 10/17/2005 or later,=20
at the link below.

ftp://ftp.ca.com/pub/iTech/downloads/

If you cannot install the update at this time, then we strongly=20
recommend that you utilize the procedural solution below.

As an immediate and completely effective remediation solution,=20
simply do not operate the iGateway component in debug diagnostic=20
trace mode. To ensure that you are not running iGateway in debug=20
mode, look for the "Debug" parameter in your igateway.conf file,=20
and make sure that it is set to "False"=20
(i.e. <Debug>False</Debug>).


Determining your version of iGateway:
To determine the version number of the iGateway component, browse
to the igateway directory and check the version listed in the=20
igateway.conf file.

On windows, this is %IGW_LOC%
Default path for v3.*: C:\Program Files\CA\igateway
Default path for v4.*: C:\Program Files\CA\SharedComponents\iTechnology

On unix,=20
Default path for v3.*: /opt/CA/igateway
Default path for v4.*: the install directory path is contained=20
in opt/CA/SharedComponents/iTechnology location. The default=20
path is /opt/CA/SharedComponents/iTechnology.

Look at the <Version> element in igateway.conf.

The versions are affected by this vulnerability if you see a=20
value LESS THAN the following:=20
<Version>4.0.050615</Version> (note the format of v.s.YYMMDD)


References:=20
CA Security Advisor site
http://www3.ca.com/securityadvisor/v...spx?id=3D33485

iGateway updates
ftp://ftp.ca.com/pub/iTech/downloads/

CVE Reference: CAN-2005-3190
http://cve.mitre.org/cgi-bin/cvename...DCAN-2005-3190

OSVDB Reference: OSVDB ID 19920=20
http://www.osvdb.org/displayvuln.php?osvdb_id=3D19920


Customers who require additional information should contact CA=20
Technical Support at http://supportconnect.ca.com.

For technical questions or comments related to this advisory,
please send email to vuln@ca.com, or contact me directly.

If you discover a vulnerability in CA products, please report
your findings to vuln@ca.com, or utilize our "Submit a=20
Vulnerability" form.
URL: http://www3.ca.com/securityadvisor/vulninfo/submit.aspx


Respectfully,

Ken Williams ; Dir. Vuln Research=20
Computer Associates ; 0xE2941985


Computer Associates International, Inc. (CA).=20
One Computer Associates Plaza. Islandia, NY 11749
=09
Contact Us http://ca.com/catalk.htm
Legal Notice http://ca.com/calegal.htm
Privacy Policy http://ca.com
Copyright 2005 Computer Associates International, Inc.
All rights reserved