Title: Computer Associates DSM 'gui_cm_ctrls.ocx' ActiveX Control Remote Code Execution Vulnerability
Severity: HIGH
Description:
Computer Associates DSM is a desktop and server management suite.
Computer Associates DSM 'gui_cm_ctrls.ocx' ActiveX control is prone to a remote code-execution vulnerability that occurs because the software fails to sufficiently validate function arguments used by the 'gui_cm_ctrls.ocx' ActiveX control.
The ActiveX control can be identified by the following CLSID:
E6239EB3-E0B0-46DA-A215-CFA9B3B740C5
Remote attackers can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will cause denial-of-service conditions.
Affected Products:
- Computer Associates ARCserve Backup for Laptops and Desktops 11.5
- Computer Associates Desktop Management Suite 11.1
- Computer Associates Desktop Management Suite 11.1 C1
- Computer Associates Desktop Management Suite 11.1 GA
- Computer Associates Desktop Management Suite 11.1a
- Computer Associates Desktop Management Suite 11.2
- Computer Associates Desktop Management Suite 11.2 C1
- Computer Associates Desktop Management Suite 11.2 C2
- Computer Associates Desktop Management Suite 11.2a
- Computer Associates Desktop and Server Management 11.1 C1
- Computer Associates Desktop and Server Management 11.1 GA
- Computer Associates Desktop and Server Management 11.1a
- Computer Associates Desktop and Server Management 11.2
- Computer Associates Desktop and Server Management 11.2 C1
- Computer Associates Desktop and Server Management 11.2 C2
- Computer Associates Desktop and Server Management 11.2a
- Computer Associates Remote Control 11.1 C1
- Computer Associates Unicenter Asset Management 11.1
- Computer Associates Unicenter Asset Management 11.1 C1
- Computer Associates Unicenter Asset Management 11.1 GA
- Computer Associates Unicenter Asset Management 11.1a
- Computer Associates Unicenter Asset Management 11.2
- Computer Associates Unicenter Asset Management 11.2 C1
- Computer Associates Unicenter Asset Management 11.2a
- Computer Associates Unicenter Desktop Management Bundle 11.1
- Computer Associates Unicenter Desktop Management Bundle 11.1 C1
- Computer Associates Unicenter Desktop Management Bundle 11.1 GA
- Computer Associates Unicenter Desktop Management Bundle 11.1a
- Computer Associates Unicenter Desktop Management Bundle 11.2
- Computer Associates Unicenter Desktop Management Bundle 11.2 C1
- Computer Associates Unicenter Desktop Management Bundle 11.2 C2
- Computer Associates Unicenter Desktop Management Bundle 11.2a
- Computer Associates Unicenter Remote Control 11.1
- Computer Associates Unicenter Remote Control 11.1 GA
- Computer Associates Unicenter Remote Control 11.1a
- Computer Associates Unicenter Remote Control 11.2
- Computer Associates Unicenter Remote Control 11.2 C1
- Computer Associates Unicenter Remote Control 11.2 C2
- Computer Associates Unicenter Remote Control 11.2a
- Computer Associates Unicenter Software Delivery 11.1
- Computer Associates Unicenter Software Delivery 11.1 C1
- Computer Associates Unicenter Software Delivery 11.1 GA
- Computer Associates Unicenter Software Delivery 11.1a
- Computer Associates Unicenter Software Delivery 11.2
- Computer Associates Unicenter Software Delivery 11.2 C1
- Computer Associates Unicenter Software Delivery 11.2 C2
- Computer Associates Unicenter Software Delivery 11.2a
References:
- Computer Associates: Computer Associates Homepage
- Computer Associates: Security Notice for CA products using the DSM gui_cm_ctrls ActiveX control
- Microsoft: Microsoft Knowledge Base Article 240797
- US-CERT: Vulnerability Note VU#684883 CA Unicenter DSM ITRM Legends ActiveX integer overf
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
