Risk
3/28/2008
08:44 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

CA Customers Newly Targeted

While most software exploits target end users and end-point applications, this one is aiming squarely at corporate users.

While most software exploits target end users and end-point applications, this one is aiming squarely at corporate users.Just last week researchers started warning about a single vulnerability that affects a large number of CA (the software vendor formally known as Computer Associates) products, from CA BrightStor ARCServe Backup through various Unicenter apps.

According to a security bulletin published by FrSIRT, the flaw in question is critical, and can lead to denial-of-service attacks and even the commandeering of the targeted system.

BTW - the error that makes all of this fun possible is (yet another) buffer overflow. (Maybe we should all start writing our representatives and demand that there be a federal "Developers: Check Your Inputs Day." It might help build some much needed awareness on a very old problem.)

This vulnerability is a big deal by itself, first because of the huge install-base of the affected products, and second because of the nature of these applications. Being able to compromise one of these systems in a corporation could make a quick stepping-stone to more crucial servers - especially considering how mushy-gushy most corporate network security is deep behind the DMZ.

What makes it more interesting, as Roger Thompson points out over at Exploit Prevention Labs is that a working attack exploit has been added to the NeoSploit attack framework.

CA has issued a patch.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-2157
Published: 2015-03-27
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.