|
|
Info |
Last Modified |
| 9 months ago |
|
|
|
|
Description |
Muliple remote overflows exist in CA License Manager. The LIC98RMT.EXE component fails to validate the parameters passed to several commands resulting in buffer overflows. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Technical |
eEye Digital Security released an advisory which specified several vulnerable commands in CA License Manager: LOG1, GETCONFIG, PUTOLF, GCR, GBR, OLFCONFIRM, GETBACKUP, GETLOG, NEWOLF, and GETSERVER. Also, any invalid command can be issued to trigger a buffer overflow.
iDefense released some advisories which elaborated on specific attacks against some of these commands, specifically GETCONFIG and PUTOLF, as well as the unchecked buffer for invalid commands.
CA credits both eEye and iDefense with discovery of this vulnerability.
|
|
Solution |
Upgrade to version 1.61.9 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
|
|
Products |
|
License Package
 |
1.61.8 |
1.53 |
|
|
|
|
|
|
Credit |
- Barnaby Jack - info
 eEye.com - eEye Digital Security
- Greg MacManus - iDEFENSE Labs
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
