Message-ID: <D7DDF83751235046BFAC82E1244EB4C808D67652@usilms23.ca.com>
Date: Fri, 14 Oct 2005 10:46:47 -0400
From: "Williams, James K" <James.Williams@...com>
To: <bugtraq@...urityfocus.com>
Subject: CAID 33485 - Computer Associates iGateway debug mode HTTP GET request buffer overflow vulnerability



Title: Computer Associates iGateway debug mode HTTP GET request 
buffer overflow vulnerability

CA Vulnerability ID: 33485

Discovery Date: 2005-10-06

CA Advisory Date: 2005-10-14

Discovered By: EMendoza


Impact: Remote attacker can execute arbitrary code with SYSTEM 
privileges.


Summary: The Computer Associates iGateway common component, which
is included with several CA products for UNIX/Linux/Windows 
platforms, contains a buffer overflow vulnerability that could 
allow remote attackers to execute arbitrary code on Windows 
platforms, or cause iGateway component failure (denial of 
service) on UNIX and Linux.  The vulnerability is due to improper
bounds checking on HTTP GET requests by the iGateway component 
when debug mode is enabled.


Mitigating Factors: The potential for exploitation of this 
vulnerability is very low for the following reasons.

1) A non-standard install of the iGateway component is required 
to expose this vulnerability.  Typically, the embedded iGateway 
component is part of a non-interactive installation process.  
Consequently, most systems (those that utilize the default 
installation procedure) are not at risk.

2) If a non-standard install WAS performed, the iGateway 
component is still unlikely to be vulnerable to this exploit, 
because the flaw is only exposed if the component has been 
manually configured to run with diagnostic debug tracing enabled.
Configuring the component to run in debug mode requires 
administrative access to configuration files that reside on the 
machine, and also requires that the iGateway service be stopped 
and restarted by someone with administrative service privileges.
Configuring the iGateway service to operate in debug mode is 
typically performed only at the direction of Computer Associates 
support personnel who are working with a customer to troubleshoot
potential support issues.


Severity: Computer Associates has given this vulnerability a 
Medium risk rating.


Affected Technologies: Please note that the iGateway component is
not a product, but rather a component that is included with 
multiple products.  The iGateway component is included in the 
following Computer Associates products, which are consequently 
potentially vulnerable.  Note that iGateway component versions 
less than 4.0.050615 are vulnerable to this issue.

Business Services Optimization (BSO) Products:
Advantage Data Transformer (ADT) R2.2
Harvest Change Manager R7.1

BrightStor Products:
BrightStor ARCserve Backup r11.5
BrightStor ARCserve Backup r11.1
BrightStor ARCserve Backup for Windows r11
BrightStor Enterprise Backup 10.5
BrightStor ARCserve Backup v9.01
BrightStor ARCserve Backup Laptop & Desktop r11.1
BrightStor ARCserve Backup Laptop & Desktop r11
BrightStor Process Automation Manager r11.1
BrightStor SAN Manager r11.1
BrightStor SAN Manager r11.5
BrightStor Storage Resource Manager r11.5 
BrightStor Storage Resource Manager r11.1 
BrightStor Storage Resource Manager 6.4
BrightStor Storage Resource Manager 6.3
BrightStor Portal 11.1

Note to BrightStor Storage Resource Manager and BrightStor Portal
users: In addition to the application servers where these 
products are installed, all hosts that have iSponsors deployed to
them for managing applications like Veritas Volume Manager and 
Tivoli TSM are also affected by this vulnerability.

eTrust Products:
eTrust Audit 1.5 SP2 (iRecorders and ARIES)
eTrust Audit 1.5 SP3 (iRecorders and ARIES)
eTrust Audit 8.0 (iRecorders and ARIES) 
eTrust Admin 8.0
eTrust Admin 8.1
eTrust Identity Minder 8.0
eTrust Secure Content Manager (SCM) R8
eTrust Web Service Security R8
eTrust Integrated Threat Management (ITM) R8

Unicenter Products: 
Unicenter CA Web Services Distributed Management R11
Unicenter AutoSys JM R11
Unicenter Management for WebLogic / Management for WebSphere R11
Unicenter Service Delivery R11
Unicenter Service Level Management (USLM) R11
Unicenter Application Performance Monitor R11
Unicenter Service Desk R11
Unicenter Service Desk Knowledge Tools R11
Unicenter Service Fulfillment 2.2
Unicenter Service Fulfillment R11
Unicenter Asset Portfolio Management R11
Unicenter Service Matrix Analysis R11
Unicenter Service Catalog/Fulfillment/Accounting R11
Unicetner MQ Management R11
Unicenter Application Server Managmenr R11
Unicenter Web Server Management R11
Unicenter Exchange Management R11 


Status and Recommendation: 
As an immediate and completely effective remediation solution, 
simply do not operate the iGateway component in debug diagnostic 
trace mode. To ensure that you are not running iGateway in debug 
mode, look for the "Debug" parameter in your igateway.conf file, 
and make sure that it is set to "False" 
(i.e. <Debug>False</Debug>).

We have developed iGateway updates to completely address this 
vulnerability. After our QA process is completed, the updates 
will be posted to our SupportConnect web site 
(http://supportconnect.ca.com). Step-by-step instructions to 
determine a) if customers are vulnerable, and b) how to remediate
the issue, will be posted to http://supportconnect.ca.com site as 
well.


Determining your version of iGateway:
To determine the version number of the iGateway component, browse
to the igateway directory and check the version listed in the 
igateway.conf file.

On windows, this is %IGW_LOC%
Default path for v3.*: C:\Program Files\CA\igateway
Default path for v4.*: C:\Program Files\CA\SharedComponents\iTechnology

On unix, 
Default path for v3.*: 	/opt/CA/igateway
Default path for v4.*: 	the install directory path is contained 
in opt/CA/SharedComponents/iTechnology location.  The default 
path is /opt/CA/SharedComponents/iTechnology.

Look at the <Version> element in igateway.conf.

The versions are affected by this vulnerability if you see a 
value LESS THAN the following: 
<Version>4.0.050615</Version>  (note the format of v.s.YYMMDD)


References: 
CA Security Advisor site
http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33485

CVE Reference: CAN-2005-3190
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3190

OSVDB Reference: OSVDB ID 19920 
http://www.osvdb.org/displayvuln.php?osvdb_id=19920


Customers who require additional information should contact CA 
Technical Support at http://supportconnect.ca.com.

For technical questions or comments related to this advisory,
please send email to vuln@...com, or contact me directly.

If you discover a vulnerability in CA products, please report
your findings to vuln@...com, or utilize our "Submit a 
Vulnerability" form.
URL: http://www3.ca.com/securityadvisor/vulninfo/submit.aspx


Respectfully,

Ken Williams ; Dir. Vuln Research 
Computer Associates ; 0xE2941985


Computer Associates International, Inc. (CA). 
One Computer Associates Plaza. Islandia, NY 11749
	
Contact Us http://ca.com/catalk.htm
Legal Notice http://ca.com/calegal.htm
Privacy Policy http://ca.com
Copyright 2005 Computer Associates International, Inc.
All rights reserved

Powered by blists - more mailing lists