Unicenter TNG Buffer Overflow and Other Bugs in Message Queueing Software Lets Remote Users Execute Arbitrary Code or Deny Service
|
|
SecurityTracker Alert ID: 1014756
|
|
SecurityTracker URL: http://securitytracker.com/id?1014756
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Aug 22 2005
|
Impact: Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Computer Associates Advisory
|
Description: A vulnerability was reported in Unicenter TNG in the Message Queuing implementation. A remote user can execute arbitrary code with
elevated privileges. A remote user can cause denial of service conditions. Other Computer Associates products are affected.
The CA Message Queuing software used in several CA products contains a buffer overflow. A remote user can cause arbitrary code to
be executed with "elevated" privileges.
A remote user can also trigger denial of service conditions via the CAM TCP port.
A
remote user may be able to spoof the CA-File Transfer Protocol to cause arbitrary commands to be executed with "elevated" privileges.
CA
Message Queuing software prior to v1.07 Build 220_13 and v1.11 Build 29_13 is affected.
|
Impact: A remote user can execute arbitrary code on the target system with elevated privileges.
A remote user can cause denial of service conditions.
|
Solution: The vendor has issued the following fixes:
Fixes for CAM v1.11 prior to Build 29_13:
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_cam111fixes.asp
Fixes for CAM v1.07 prior to Build 220_13:
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_cam107fixes.asp
Fixes
for CAM v1.05 (any version):
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_cam107fixes.asp
|
Vendor URL: supportconnectw.ca.com/public/ca_common_docs/camsecurity_notice.asp (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 22 Aug 2005 13:20:16 -0400
Subject: http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_notice.asp
|
> The CA Customer Support team has recently become aware of several vulnerability
> issues in the CA Message Queuing (CAM / CAFT) software:
>
> * The CAM TCP port is potentially vulnerable to a Denial of Service (DoS) attack.
> * Buffer overflow conditions can potentially allow arbitrary code to be executed
> remotely with elevated privileges.
> * Potential to launch a spoof CAFT and allow arbitrary commands to be executed
> with elevated privileges.
|
|
