HTTP: CA Multiple Product AV Engine CAB Header Parsing Stack Overflow

There exists a stack-based buffer overflow vulnerability in multiple Computer Associates products. The vulnerability exists in the component that processes CAB files. A remote unauthenticated attacker can exploit the vulnerability causing a denial of service condition or the execution of arbitrary code on the target system through delivering a specially crafted CAB file to the target. In an attack case where code injection is not successful, the affected application will terminate abnormally. In a more sophisticated attack where code injection results is successful, the behaviour of the target is entirely dependent on the intended function of the injected code. The code in such a case would execute within the security context of the affected application, normally

Extended Description

Multiple Computer Associates products are prone to a remote stack-based buffer-overflow vulnerability because the scan engine fails to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer. A successful exploit will allow an attacker to execute arbitrary code with SYSTEM-level privileges.

Affected Products

Computer_associates etrust_ez_antivirus

References

BugTraq: 24330

CVE: CVE-2007-2864

Short Name

HTTP:STC:DL:AV-CAB-HEADER

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: CA Multiple Product AV Engine CAB Header Parsing Stack Overflow

Extended Description

Affected Products

References

Found a potential security threat?