----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

Join the FREE BETA test of the Network Software Inspector (NSI)!
http://secunia.com/network_software_inspector/

The NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.

----------------------------------------------------------------------

TITLE:
CA Products Buffer Overflow and Privilege Escalation Vulnerabilities

SECUNIA ADVISORY ID:
SA25202

VERIFY ADVISORY:
http://secunia.com/advisories/25202/

CRITICAL:
Moderately critical

IMPACT:
Privilege escalation, System access

WHERE:
>From local network

SOFTWARE:
CA Anti-Spyware 8.x
http://secunia.com/product/10673/
CA Threat Manager 8.x
http://secunia.com/product/7112/
CA Anti-Virus for the Enterprise 8.x
http://secunia.com/product/10672/

http://secunia.com/product//

DESCRIPTION:
Two vulnerabilities have been reported in various CA products, which
can be exploited by malicious users to gain escalated privileges and
by malicious people to compromise a vulnerable system.

1) A boundary error within the inoweb service when processing Console
Server login credentials can be exploited to cause a stack-based
buffer overflow via sending a specially crafted packet with overly
long username and password fields to port 12168/TCP.

Successful exploitation allows execution of arbitrary code but
requires an installation on the x86 platform with the Console Server
installed.

The vulnerability affects the following products:
* CA Anti-Virus for the Enterprise (formally eTrust Antivirus) r8
* CA Threat Manager (formally eTrust Integrated Threat Management)
r8
* CA Anti-Spyware (formally eTrust PestPatrol) r8
* CA Protection Suites r3

2) The problem is that the Task Service component (InoTask.exe) uses
a shared file mapping with a NULL security descriptor. This can be
exploited by malicious users to cause a stack-based buffer overflow
within InoCore.dll by modifying a certain string within the file
mapping.

Successful exploitation allows execution of arbitrary code with
SYSTEM privileges.

The vulnerability affects the following products:
* CA Anti-Virus for the Enterprise (formally eTrust Antivirus) r8
* CA Threat Manager (formally eTrust Integrated Threat Management) r8

SOLUTION:
Patches are available via automatic updates.

PROVIDED AND/OR DISCOVERED BY:
1) Discovered by Tenable Network Security and reported via ZDI.
2) Discovered by binagres and reported via iDefense Labs.

ORIGINAL ADVISORY:
CA:
http://supportconnectw.ca.com/public/antivirus/infodocs/caav-secnotice050807.asp

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-028.html

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=530

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------