CVE-2007-2523 - CA Anti-Virus for the Enterprise r8 and Threat Manager r8 before 20070510 use weak permissions (NULL

CVE-2007-2523

Summary

CA Anti-Virus for the Enterprise r8 and Threat Manager r8 before 20070510 use weak permissions (NULL security descriptor) for the Task Service shared file mapping, which allows local users to modify this mapping and gain privileges by triggering a stack-based buffer overflow in InoCore.dll before 8.0.448.0. The Computer Associates Integrated Threat Manager product is only vulnerable if it is release 8.0 before 2007-05-10.

References

Vulnerable Configurations

cpe:2.3:a:broadcom:integrated_threat_management:8.0:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:integrated_threat_management:8.0:*:*:*:*:*:*:*
cpe:2.3:a:ca:anti-virus_for_the_enterprise:8:*:enterprise:*:*:*:*:*
cpe:2.3:a:ca:anti-virus_for_the_enterprise:8:*:enterprise:*:*:*:*:*

CVSS

Base:	7.2 (as of 09-04-2021 - 17:04)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:L/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bid	23906
bugtraq	20070511 Computer Associates eTrust InoTask.exe Antivirus Buffer Overflow Vulnerability
cert-vn	VU#788416
confirm	http://supportconnectw.ca.com/public/antivirus/infodocs/caav-secnotice050807.asp
fulldisc	20050711 [CAID 35330, 35331]: CA Anti-Virus, CA Threat Manager, and CA Anti-Spyware Console Login and File Mapping Vulnerabilities
idefense	20070509 Computer Associates eTrust InoTask.exe Antivirus Buffer Overflow Vulnerability
misc	http://blog.48bits.com/?p=103
osvdb	34586
sectrack	1018043
secunia	25202
vupen	ADV-2007-1750

saint via4

bid	23906
description	CA Console Server username buffer overflow
id	misc_av_caetrustitm
osvdb	34585
title	ca_console_login
type	remote

Last major update

09-04-2021 - 17:04

Published

11-05-2007 - 04:20

Last modified

09-04-2021 - 17:04