{"api_version":"1","generated_at":"2026-07-23T11:04:47+00:00","cve":"CVE-2011-2667","urls":{"html":"https://cve.report/CVE-2011-2667","api":"https://cve.report/api/cve/CVE-2011-2667.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-2667","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-2667"},"summary":{"title":"CVE-2011-2667","description":"Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and daemon crash) via a malformed request.","state":"PUBLISHED","assigner":"mitre","published_at":"2011-07-28 22:55:02","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-119","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"10","severity":"","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.securityfocus.com/archive/1/518935/100/0/threaded","name":"http://www.securityfocus.com/archive/1/518935/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1025813","name":"http://securitytracker.com/id?1025813","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CA Total Defense URL Processing Flaw Lets Remote Users Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/48813","name":"http://www.securityfocus.com/bid/48813","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Computer Associates Total Defense and Gateway Security Remote Code Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://securityreason.com/securityalert/8316","name":"http://securityreason.com/securityalert/8316","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CA Gateway Security and Total Defense - CXSecurity.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-11-237/","name":"http://www.zerodayinitiative.com/advisories/ZDI-11-237/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Zero Day Initiative","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/518934/100/0/threaded","name":"http://www.securityfocus.com/archive/1/518934/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/68736","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/68736","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1025812","name":"http://securitytracker.com/id?1025812","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CA Gateway Security URL Processing Flaw Lets Remote Users Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/45332","name":"http://secunia.com/advisories/45332","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"CA Gateway Security URL Parsing Vulnerability - Advisories - Community","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B5E404992-6B58-4C44-A29D-027D05B6285D%7D","name":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B5E404992-6B58-4C44-A29D-027D05B6285D%7D","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"error - ecx_site - ECX","mime":"text/html","httpstatus":"404","archivestatus":"400"},{"url":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={5E404992-6B58-4C44-A29D-027D05B6285D}","name":"CONFIRM:https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={5E404992-6B58-4C44-A29D-027D05B6285D}","refsource":"MITRE","tags":[],"title":"404 Not Found","mime":"text/html","httpstatus":"404","archivestatus":"400"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2667","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2667","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"2667","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"broadcom","cpe5":"total_defense","cpe6":"r12","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"2667","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ca","cpe5":"gateway_security","cpe6":"8.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T23:08:23.762Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-11-237/"},{"name":"20110720 CA20110720-01: Security Notice for CA Gateway Security and Total Defense","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/518935/100/0/threaded"},{"name":"1025812","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1025812"},{"name":"8316","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/8316"},{"name":"20110720 ZDI-11-237: CA Total Defense Suite Gateway Security Malformed HTTP Packet Remote Code Execution Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/518934/100/0/threaded"},{"name":"48813","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/48813"},{"name":"totaldefense-gateway-url-code-execution(68736)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/68736"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B5E404992-6B58-4C44-A29D-027D05B6285D%7D"},{"name":"1025813","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1025813"},{"name":"45332","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/45332"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2011-07-20T00:00:00.000Z","descriptions":[{"lang":"en","value":"Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and daemon crash) via a malformed request."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-09T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-11-237/"},{"name":"20110720 CA20110720-01: Security Notice for CA Gateway Security and Total Defense","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/518935/100/0/threaded"},{"name":"1025812","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1025812"},{"name":"8316","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/8316"},{"name":"20110720 ZDI-11-237: CA Total Defense Suite Gateway Security Malformed HTTP Packet Remote Code Execution Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/518934/100/0/threaded"},{"name":"48813","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/48813"},{"name":"totaldefense-gateway-url-code-execution(68736)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/68736"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B5E404992-6B58-4C44-A29D-027D05B6285D%7D"},{"name":"1025813","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1025813"},{"name":"45332","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/45332"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2011-2667","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and daemon crash) via a malformed request."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.zerodayinitiative.com/advisories/ZDI-11-237/","refsource":"MISC","url":"http://www.zerodayinitiative.com/advisories/ZDI-11-237/"},{"name":"20110720 CA20110720-01: Security Notice for CA Gateway Security and Total Defense","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/518935/100/0/threaded"},{"name":"1025812","refsource":"SECTRACK","url":"http://securitytracker.com/id?1025812"},{"name":"8316","refsource":"SREASON","url":"http://securityreason.com/securityalert/8316"},{"name":"20110720 ZDI-11-237: CA Total Defense Suite Gateway Security Malformed HTTP Packet Remote Code Execution Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/518934/100/0/threaded"},{"name":"48813","refsource":"BID","url":"http://www.securityfocus.com/bid/48813"},{"name":"totaldefense-gateway-url-code-execution(68736)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/68736"},{"name":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={5E404992-6B58-4C44-A29D-027D05B6285D}","refsource":"CONFIRM","url":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={5E404992-6B58-4C44-A29D-027D05B6285D}"},{"name":"1025813","refsource":"SECTRACK","url":"http://securitytracker.com/id?1025813"},{"name":"45332","refsource":"SECUNIA","url":"http://secunia.com/advisories/45332"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2011-2667","datePublished":"2011-07-28T22:00:00.000Z","dateReserved":"2011-07-06T00:00:00.000Z","dateUpdated":"2024-08-06T23:08:23.762Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2011-07-28 22:55:02","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-119","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:total_defense:r12:*:*:*:*:*:*:*","matchCriteriaId":"EAD87D20-B6C6-4D48-BEF7-5960AB2060D0"},{"vulnerable":true,"criteria":"cpe:2.3:a:ca:gateway_security:8.1:*:*:*:*:*:*:*","matchCriteriaId":"DF520BDD-DF53-4EB8-9DFE-CCDE422473D0"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"2667","Ordinal":"1","Title":"CVE-2011-2667","CVE":"CVE-2011-2667","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"2667","Ordinal":"1","NoteData":"Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and daemon crash) via a malformed request.","Type":"Description","Title":"CVE-2011-2667"},{"CveYear":"2011","CveId":"2667","Ordinal":"2","NoteData":"2011-07-28","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"2667","Ordinal":"3","NoteData":"2018-10-09","Type":"Other","Title":"Modified"}]}}}