APP: CA Products Message Queuing Server Buffer Overflow

This signature detects attempts to exploit a known buffer overflow vulnerability in the way CA Message Queuing Server handles incoming packets. It is due to lack of boundary protection while processing packets. A remote unauthenticated attacker can exploit this to cause a denial-of-service condition or inject and execute arbitrary code on the system within the security context of the affected service, normally System. Also, in a successful code injection attack, the behavior of the target is entirely dependent on the intended function of the injected code and would execute within the security context of the affected service. In an unsuccessful code injection attack, the affected server terminates.

Extended Description

Multiple Computer Associates products are prone to a remote stack-based buffer-overflow vulnerability. This issue affects the Message Queuing (CAM/CAFT) component. The application fails to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer. A successful exploit will allow an attacker to execute arbitrary code with SYSTEM-level privileges. This issue affects all versions of the CA Message Queuing software prior to v1.11 Build 54_4 on Windows and NetWare.

Affected Products

Computer_associates cleverpath_aion

References

BugTraq: 25051

CVE: CVE-2007-0060

Short Name

APP:CA:MESSAGE-QUEUE-HEAP

Severity

Critical

Recommended

False

Recommended Action

Drop

APP: CA Products Message Queuing Server Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?