CVE-2007-5004

CVE-2007-5004 affects CA BrightStor ARCserve Backup for Laptops and Desktops (LGServer) r11.0–r11.5. An integer overflow in processing the authentication password (long username and crafted password) could allow a remote attacker to execute arbitrary code. Connected advisories/SAINT notes indicat...

CVE-2007-5084

Multiple SQL injection vulnerabilities in Computer Associates CA BrightStor Hierarchical Storage Manager HSM before r11.6 allow remote attackers to execute arbitrary SQL commands via CsAgent service commands with opcodes 1 0x07, 2 0x08, 3 0x09, 4 0x1E, 5 0x32, 6 0x36, 7 0x40, and possibly others...

iDefense Security Advisory 09.27.07: Computer Associates BrightStor HSM r11.5 Multiple Vulnerabilities

Computer Associates BrightStor HSM r11.5 Multiple Vulnerabilities iDefense Security Advisory 09.27.07 http://labs.idefense.com/intelligence/vulnerabilities/ Sep 27, 2007 I. BACKGROUND Computer Associates BrightStor Hierarchical Storage Manager HSM is an application used to create a tiered storage...

CA BrightStor HSM Buffer Overflow

This module exploits one of the multiple stack buffer overflows in Computer Associates BrightStor HSM. By sending a specially crafted request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/brightstor/hsmserver msf undefinedhsmserver show...

CA ARCserve Backup多个远程溢出及目录遍历漏洞

BUGTRAQ ID: 24348 CVECAN ID: CVE-2007-3216,CVE-2007-5003,CVE-2007-5004,CVE-2007-5005,CVE-2007-5006 ARCServe Backup for Laptops and Desktops L&D是适用于中小业务的ARCServe Backup备份工具版本。 ARCserve L&D在处理RPC接口上的畸形请求数据时存在漏洞，远程攻击者可能利用此漏洞控制服务器或执行目录遍历。 ARCserve L&D使用TCP/1900端口做为RPC接口管理ARCserve L&D服务器，正常的通讯示例如下：...

EEYE: Multiple Vulnerabilities in CA ARCserve for Laptops & Desktops

Multiple Vulnerabilities in CA ARCserve for Laptops & Desktops Release Date: September 20, 2007 Date Reported: June 5, 2007 Severity: High Remote Code Execution Vendor: Computer Associates CA Systems Affected: CA ARCserve Backup for Laptops and Desktops r11.5 CA ARCserve Backup for Laptops and...

CA eTrust多个产品Arclib.DLL畸形CHM文件处理拒绝服务漏洞

BUGTRAQ ID: 25049 CVECAN ID: CVE-2007-3875 eTrust是CA推出的系列杀毒产品，现在更名为Anti-Virus for the Enterprise、Threat Manager、Anti-Spyware for the Enterprise等产品。 eTrust产品中的Arclib.DLL库存在安全漏洞，如果杀毒引擎扫描到了设置有无效previous listing chunk number字段的畸形CHM文件，扫描程序就会陷入死循环，无法再处理其他文件。 Computer Associates eTrust Antivirus r8.1...

CA ETrust Intrusion Detection Caller.dll控件远程代码执行漏洞

BUGTRAQ ID: 25050 CVECAN ID: CVE-2007-3302 CA的eTrust Intrusion Detection是功能强大的基于网络的入侵检测系统。 eTrust Intrusion Detection的ActiveX控制实现上存在漏洞，远程攻击者可能利用此漏洞控制用户系统。 在安装eTrust Intrusion Detection时会注册以下ActiveX控件： 文件：Caller.dll Clsid：41266C21-18D8-414B-88C0-8DCA6C25CEA0...

iDefense Security Advisory 07.24.07: Computer Associates eTrust Intrusion Detection CallCode ActiveX Control Code Execution Vulnerability

Computer Associates eTrust Intrusion Detection CallCode ActiveX Control Code Execution Vulnerability iDefense Security Advisory 07.24.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 24, 2007 I. BACKGROUND Computer Associates eTrust Intrusion Detection is a network intrusion manageme...

iDefense Security Advisory 07.24.07: Computer Associates AntiVirus CHM File Handling DoS Vulnerability

Computer Associates AntiVirus CHM File Handling DoS Vulnerability iDefense Security Advisory 07.24.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 24, 2007 I. BACKGROUND eTrust is an antivirus application developed by Computer Associates. More information can be found on the vendor'...

Computer Associates eTrust Intrusion Detection code execution

CallCode ActiveX allows access to unsafe functions...

Computer Associates AntiVirus DoS

Buffer overflow on CHM and RAR files parsing...

Computer Associates Alert Notification Server buffer overflow

Added: 07/19/2007 CVE: CVE-2007-3825 BID: 24947 OSVDB: 36096 Background The Alert Notification Server is included with multiple Computer Associates products to provide notifications to console users. Problem The Alert Notification Server is affected by buffer overflow vulnerabilities in multiple...

iDefense Security Advisory 07.17.07: Computer Associates Alert Notification Server Multiple Buffer Overflow Vulnerabilities

Computer Associates Alert Notification Server Multiple Buffer Overflow Vulnerabilities iDefense Security Advisory 07.17.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 17, 2007 I. BACKGROUND Computer Associates Alert Notification Server is used by several CA products, including eTru...

Computer Associates Alert Notification Server buffer overflow

Added: 07/19/2007 CVE: CVE-2007-3825 BID: 24947 OSVDB: 36096 Background The Alert Notification Server is included with multiple Computer Associates products to provide notifications to console users. Problem The Alert Notification Server is affected by buffer overflow vulnerabilities in multiple...

Computer Associates Alert Notification Server buffer overflow

Added: 07/19/2007 CVE: CVE-2007-3825 BID: 24947 OSVDB: 36096 Background The Alert Notification Server is included with multiple Computer Associates products to provide notifications to console users. Problem The Alert Notification Server is affected by buffer overflow vulnerabilities in multiple...

Computer Associates Alert Notification Server buffer overflow

Added: 07/19/2007 CVE: CVE-2007-3825 BID: 24947 OSVDB: 36096 Background The Alert Notification Server is included with multiple Computer Associates products to provide notifications to console users. Problem The Alert Notification Server is affected by buffer overflow vulnerabilities in multiple...

CA产品警告通知服务器远程栈溢出漏洞

CVECAN ID: CVE-2007-3825 警告通知服务器（alert.exe）是很多CA产品都在使用的服务，用于为控制台用户提供通知。 警告通知服务器所注册的RPC接口（GUID 3d742890-397c-11cf-9bf1-00805f88cb72）存在栈溢出漏洞。如果远程攻击者向该服务接口提交了超长的RPC请求的话，就可能触发这个溢出，导致以系统权限执行任意指令。 可使用SMB协议到达有漏洞的代码，因此在Windows XP及之后系统上必须有效的认证凭据，而Windows 2000无须认证。 Computer Associates BrightStor ARCserve...

CA BrightStor ARCserve Backup Server未明远程代码执行漏洞

Computer Associates BrightStor ARCserve Backup是一款企业级别的备份解决方案。 Computer Associates BrightStor ARCserve Backup存在未明安全问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 目前没有详细漏洞细节提供。 Computer Associates BrightStor ARCServe Backup 11.5.SP3 目前没有解决方案提供： http://www3.ca.com/Solutions/ProductFamily.asp?ID=115...

CVE-2007-3337

CVE-2007-3337 concerns the Ingres database server (2006 9.0.4 and earlier) used in multiple CA products. A local user can abuse the setuid root binary “wakeup” by creating a symbolic link to the file alarmwkp.def, causing the binary to truncate arbitrary files in the current directory. The issue ...