HTTP: CA BrightStor ARCserve Backup AddColumn ActiveX Buffer Overflow

This signature detects attempts to exploit a known vulnerability in CA BrightStor ARCserve Backup ActiveX Control (ListCtrl.ocx). An attacker can create a malicious Web site containing Web pages with dangerous ActiveX calls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

The Unicenter DSM r11 List Control ATX ActiveX control, included with CA BrightStor ARCserve Backup, is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. An attacker can exploit this issue to execute arbitrary code in the context of an application running the control (typically Internet Explorer). Failed attacks will cause denial-of-service conditions.

Affected Products

Computer_associates unicenter_remote_control

References

BugTraq: 28268

CVE: CVE-2008-1472

Short Name

HTTP:STC:ACTIVEX:ADDCOLUMN

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: CA BrightStor ARCserve Backup AddColumn ActiveX Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?