SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Unicenter Service Level Management Vendors:   CA
Unicenter Service Level Management Buffer Overflow and Other Bugs in Message Queueing Software Lets Remote Users Execute Arbitrary Code or Deny Service
SecurityTracker Alert ID:  1014764
SecurityTracker URL:  http://securitytracker.com/id/1014764
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Aug 23 2005
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.0, 3.0.1, 3.0.2, 3.5
Description:   A vulnerability was reported in Unicenter Service Level Management in the Message Queuing implementation. A remote user can execute arbitrary code with elevated privileges. A remote user can cause denial of service conditions. Other Computer Associates products are affected.

The CA Message Queuing software used in several CA products contains a buffer overflow. A remote user can cause arbitrary code to be executed with elevated privileges.

A remote user can also trigger denial of service conditions via the CA Message Queuing TCP port.

A remote user may be able to spoof the CA-File Transfer Protocol to cause arbitrary commands to be executed with elevated privileges.

CA Message Queuing software prior to v1.07 Build 220_13 and v1.11 Build 29_13 is affected.

The vulnerability was discovered by the vendor in an internal audit.

Impact:   A remote user can execute arbitrary code on the target system with elevated privileges.

A remote user can cause denial of service conditions.

Solution:   The vendor has provided the following fixes.

Fixes for CAM v1.11 prior to Build 29_13:

http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_cam111fixes.asp

Windows QO71014
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71014

AIX QO71015
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71015

HPUX QO71016
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71016

Linux QO71019
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71019

QO71020 (RPM_i386)
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71020

QO71021 (RPM_ia64)
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71021

LinuxS390 QO71031
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71031

MacOSX QO71022
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71022

NetWare QO71023
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71023

OSF1 QO71024
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71024

SCO QO71025
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71025

Solaris QO71026
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71026

SolarisIntel QO71027
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71027

Fixes for CAM v1.07 prior to Build 220_13 and Fixes for CAM v1.05 (any version):

http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_cam107fixes.asp

Windows QO71033
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71033

AIX QO71035
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71035

AS/400 On Request
http://supportconnect.ca.com

DGIntel QO71036
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71036

DGM88K QO71037
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71037

DYNIX QO71038
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71038

HPUX QO71040
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71040

IRIX QO71041
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71041

Linux QO71042
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71042

LinuxS390 QO71085
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71085

NCR QO71043
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71043

NetWare QO71044
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71044

OS/2 On Request
http://supportconnect.ca.com

OSF1 QO71045
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71045

SCO QO71046
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71046

SINIX QO71047
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71047

Solaris QO71048
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71048

SolarisIntel QO71049
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71049

Unixware7 QO71050
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO71050

OpenVMS On Request
http://supportconnect.ca.com

[Editor's note: All available Message Queuing fixes are listed above. However, not all of the fixes may apply to this particular CA product.]

Vendor URL:  supportconnectw.ca.com/public/ca_common_docs/camsecurity_notice.asp (Links to External Site)
Cause:   Authentication error, Boundary error
Underlying OS:  Linux (Red Hat Enterprise), Linux (Red Hat Linux), Linux (SuSE), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (NT), Windows (2000), Windows (2003)

Message History:   None.


 Source Message Contents

Subject:  32919 - Computer Associates Message Queuing (CAM/CAFT) multiple vulnerabilities

Title: 32919 - Computer Associates Message Queuing (CAM/CAFT) 
multiple vulnerabilities


CA Vulnerability ID: CAID 32919


Disclosure Date: 2005-08-19


Discovered By: CA internal audit


Impact: Remote attackers can execute arbitrary code, or cause a 
denial of service condition.


Summary: During a recent internal audit, CA discovered several 
vulnerability issues in the CA Message Queuing (CAM / CAFT) 
software.

1) Attackers can potentially exploit a CAM TCP port vulnerability
to execute a Denial of Service (DoS) attack.

2) Attackers can potentially exploit multiple buffer overflow 
conditions to execute arbitrary code remotely with elevated 
privileges.

3) Attackers can potentially launch a spoofed CAFT attack, and 
execute arbitrary commands with elevated privileges.

CA has made patches available for all affected users.  These 
vulnerabilities affect all versions of the CA Message Queuing 
software prior to v1.07 Build 220_13 and v1.11 Build 29_13 on the
platforms specified below.


Severity: Computer Associates has given this vulnerability a High
risk rating.


Determining CAM versions:

Simply running camstat will return the version information in the
top line of the output on any platform. The camstat program is 
located in the "bin" subfolder of the installation directory.

The example below indicates that CAM version 1.11 build 27 
increment 2 is running.

E:\>camstat
CAM - machine.ca.com Version 1.11 (Build 27_2) up 0 days 1:16


Determining the CAM install directory:

Windows: the install location is specified by the %CAI_MSQ% 
environment variable.

Unix/Linux/Mac: the /etc/catngcampath text file holds the CAM 
install location.


Affected products:

Unicenter Performance Management for OpenVMS r2.4 SP3
AdviseIT 2.4
Advantage Data Transport 3.0
BrightStor SAN Manager 1.1, 1.1 SP1, 1.1 SP2, 11.1
BrightStor Portal 11.1
CleverPath OLAP 5.1
CleverPath ECM 3.5
CleverPath Predictive Analysis Server 2.0, 3.0
CleverPath Aion 10.0
eTrust Admin 2.01, 2.04, 2.07, 2.09, 8.0, 8.1
Unicenter Application Performance Monitor 3.0, 3.5
Unicenter Asset Management 3.1, 3.2, 3.2 SP1, 3.2 SP2, 4.0, 
     4.0 SP1
Unicenter Data Transport Option 2.0
Unicenter Enterprise Job Manager 1.0 SP1, 1.0 SP2
Unicenter Jasmine 3.0
Unicenter Management for WebSphere MQ 3.5
Unicenter Management for Microsoft Exchange 4.0, 4.1
Unicenter Management for Lotus Notes/Domino 4.0
Unicenter Management for Web Servers 5, 5.0.1
Unicenter NSM 3.0, 3.1
Unicenter NSM Wireless Network Management Option 3.0
Unicenter Remote Control 6.0, 6.0 SP1
Unicenter Service Level Management 3.0, 3.0.1, 3.0.2, 3.5
Unicenter Software Delivery 3.0, 3.1, 3.1 SP1, 3.1 SP2, 4.0, 
     4.0 SP1
Unicenter TNG 2.1, 2.2, 2.4, 2.4.2
Unicenter TNG JPN 2.2


Affected platforms:

AIX, DG Intel, DG Motorola, DYNIX, OSF1, HP-UX, IRIX, 
Linux Intel, Linux s/390, Solaris Intel, Solaris Sparc, UnixWare,
Windows, Apple Mac, AS/400, MVS, NetWare, OS/2, and OpenVMS.


Status: Patches that completely remediate this vulnerability 
issue are available for all affected products.


Recommendation (note that URLs may wrap): 
CA strongly recommends application of the appropriate patch(es).

Fixes for CAM v1.11 prior to Build 29_13:
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_cam111fi
xes.asp
Windows QO71014
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7101
4
AIX QO71015
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7101
5
HPUX QO71016
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7101
6
Linux QO71019
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7101
9
QO71020 (RPM_i386)
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
0
QO71021 (RPM_ia64)
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
1
LinuxS390 QO71031
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7103
1
MacOSX QO71022
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
2
NetWare QO71023
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
3
OSF1 QO71024
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
4
SCO QO71025
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
5
Solaris QO71026
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
6
SolarisIntel QO71027
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7102
7

Fixes for CAM v1.07 prior to Build 220_13 
and Fixes for CAM v1.05 (any version):
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_cam107fi
xes.asp
Windows QO71033
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7103
3
AIX QO71035
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7103
5
AS/400 On Request
http://supportconnect.ca.com
DGIntel QO71036
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7103
6
DGM88K QO71037
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7103
7
DYNIX QO71038
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7103
8
HPUX QO71040
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
0
IRIX QO71041
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
1
Linux QO71042
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
2
LinuxS390 QO71085
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7108
5
NCR QO71043
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
3
NetWare QO71044
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
4
OS/2 On Request
http://supportconnect.ca.com
OSF1 QO71045
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
5
SCO QO71046
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
6
SINIX QO71047
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
7
Solaris QO71048
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
8
SolarisIntel QO71049
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7104
9
Unixware7 QO71050
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO7105
0
OpenVMS On Request
http://supportconnect.ca.com


Customers wishing to patch their Master Image CD sets should 
refer to the solution areas on the product home pages 
(http://supportconnectw.ca.com/main.asp).

USD/SDO package for the CA Message Queuing vulnerability
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_faqs.asp
#faqsdo

UAM/AMO Definitions for the CA Message Queuing vulnerability
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_faqs.asp
#faqamo


CVE Reference: Pending

OSVDB Reference: Pending


Advisory URLs (note that URLs may wrap): 
 
CA Message Queuing Security Notice
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_notice.a
sp

CA Security Advisor site: CAID 32919 - Computer Associates 
Message Queuing (CAM/CAFT) multiple vulnerabilities
http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=32919

CA Message Queuing Security Notice Frequently Asked Questions
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_faqs.asp


Should you require additional information, please contact CA 
Customer Support at http://supportconnect.ca.com.
CA Customer Support North America (individual product hotlines)
http://supportconnectw.ca.com/public/ca_common_docs/support_dir.pdf
CA International Customer Support (individual country offices)
http://www.ca.com/camap.htm


Respectfully,

Ken Williams ; Dir. Vuln Research 
Computer Associates ; 0xE2941985


Computer Associates International, Inc. (CA). 
One Computer Associates Plaza. Islandia, NY 11749
	
Contact Us http://ca.com/catalk.htm
Legal Notice http://ca.com/calegal.htm
Privacy Policy http://ca.com
Copyright 2005 Computer Associates International, Inc.
All rights reserved
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC