________________________________________________________________________

               Computer Associates (CA) Anti-Virus
          Multiple products - arbitrary code execution
________________________________________________________________________

Release mode  : Coordinated
Reference     : [GSEC-46-2009] - Computer Associates multiple products RCE
WWW           : http://blog.g-sec.lu/2009/10/computer-associates-multiple-products.html
Vendor        : http://www.ca.com
Status        : Patched
CVE           : CVE-2009-3587 & CVE-2009-3588
Credit        : https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=218878
Discovered by : Thierry Zoller (G-SEC)
Vendor reaction rating : near perfect*
*
Continous feedback on progress - CVE numbers - In depth investigation of the issues at hand


Affected products : 
~~~~~~~~~~~~~~~~~~~
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) r8
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) r8.1
CA Anti-Virus 2007 (v8)
CA Anti-Virus 2008
CA Anti-Virus 2009
CA Anti-Virus Plus 2009
eTrust EZ Antivirus r7.1
CA Internet Security Suite 2007 (v3)
CA Internet Security Suite 2008
CA Internet Security Suite Plus 2008
CA Internet Security Suite Plus 2009
CA Threat Manager for the Enterprise (formerly eTrust Integrated 
   Threat Management) r8
CA Threat Manager for the Enterprise (formerly eTrust Integrated 
   Threat Management) 8.1
CA Threat Manager Total Defense
CA Gateway Security r8.1
CA Protection Suites r2
CA Protection Suites r3
CA Protection Suites r3.1
CA Secure Content Manager (formerly eTrust Secure Content 
   Manager) 1.1
CA Secure Content Manager (formerly eTrust Secure Content 
   Manager) 8.0
CA Network and Systems Management (NSM) (formerly Unicenter 
   Network and Systems Management) r3.0
CA Network and Systems Management (NSM) (formerly Unicenter 
   Network and Systems Management) r3.1
CA Network and Systems Management (NSM) (formerly Unicenter 
   Network and Systems Management) r11
CA Network and Systems Management (NSM) (formerly Unicenter 
   Network and Systems Management) r11.1
CA ARCserve Backup r11.5 on Windows
CA ARCserve Backup r12 on Windows
CA ARCserve Backup r12.0 SP1 on Windows
CA ARCserve Backup r12.0 SP 2 on Windows
CA ARCserve Backup r12.5 on Windows
CA ARCserve Backup r11.1 Linux
CA ARCserve Backup r11.5 Linux
CA ARCserve for Windows Client Agent
CA ARCserve for Windows Server component
CA eTrust Intrusion Detection 2.0 SP1
CA eTrust Intrusion Detection 3.0
CA eTrust Intrusion Detection 3.0 SP1
CA Common Services (CCS) r3.1
CA Common Services (CCS) r11
CA Common Services (CCS) r11.1
CA Anti-Virus SDK (formerly eTrust Anti-Virus SDK)
CA Anti-Virus Gateway (formerly eTrust Antivirus Gateway) 7.1

Affected Plattforms:
~~~~~~~~~~~~~~~~~~~
Windows
UNIX
Linux
Solaris
Mac OS X
Netware


Patch availability :
~~~~~~~~~~~~~~~~~~~~
Patches have been available since the 09.10.2009 - Please follow the steps listed
here: https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=218878


I. Background
~~~~~~~~~~~~~
Quote: 
"CA is one of the world's largest IT management software providers.
We serve more than 99% of Fortune 1000 companies, as well as government 
entities, educational institutions and thousands of other companies 
in diverse industries worldwide" 

"CA Anti-Virus for the Enterprise is the next generation in comprehensive 
anti-virus security for business PCs, servers and PDAs. It combines 
proactive protection against malware with new, powerful management 
features that stop and remove malicious code before it enters your 
network, reducing system downtime"


II. Description
~~~~~~~~~~~~~~~
Improper handling of a specially crafted RAR archive file by the CA 
Anti-Virus engine arclib component leads to heap corruption and 
allows the attacker to cause a denial of service or possibly 
further compromise the system.

Attacker has control over EBX :

Basic Block:
    6e4305b0 mov cl,byte ptr [ebx]
       Tainted Input Operands: ebx
    6e4305b2 add edi,28h
    6e4305b5 push edi
    6e4305b6 lea edx,[esp+14h]
    6e4305ba mov byte ptr [esp+14h],cl
       Tainted Input Operands: cl
    6e4305be inc ebx
       Tainted Input Operands: ebx
    6e4305bf push edx
    6e4305c0 mov ecx,esi
    6e4305c2 mov dword ptr [esp+1ch],ebx
       Tainted Input Operands: ebx
    6e4305c6 call arclib!arctkopenarchive+0x283a0 (6e42f9f0)
        
        

III. Impact
~~~~~~~~~~~
The impact ranges from Denial of Service to potential remote arbitrary code execution.
Due to the nature of Anti-virus products, the attack vectors can be near endless. An attack
could be done over the way of an E-mail message carrying an RAR attachment (of a file
recognised as being RAR), USB, CD, Network data etc.

Please note that this is a general problem and not exclusive to Computer Associates.


IV. Disclosure timeline
~~~~~~~~~~~~~~~~~~~~~~~~~
DD.MM.YYYY
11.05.2009 - Reported CVE-2009-3587 
03.06.2009 - Reported CVE-2009-3588
09.10.2009 - CA releases advisory
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=218878
13.10.2009 - G-SEC releases advisory