Computer Associates Multiple Product HTTP Request Remote Buffer Overflow Vulnerability

BID:15025

Info

Computer Associates Multiple Product HTTP Request Remote Buffer Overflow Vulnerability

Bugtraq ID: 15025
Class: Boundary Condition Error
CVE:
Remote: Yes
Local: No
Published: Oct 06 2005 12:00AM
Updated: Oct 06 2005 12:00AM
Credit: Erika Mendoza <[email protected]> disclosed this vulnerability.
Vulnerable: Computer Associates Unicenter Web Server Management 11.0
Computer Associates Unicenter Service Matrix Analysis 11.0
Computer Associates Unicenter Service Level Management 11.0
Computer Associates Unicenter Service Fulfillment 11.0
Computer Associates Unicenter Service Fulfillment 2.2
Computer Associates Unicenter Service Desk Knowledge Tools 11.0
Computer Associates Unicenter Service Desk 11.0
Computer Associates Unicenter Service Delivery 11.0
Computer Associates Unicenter Service Catalog/Fulfillment/Accounting 11.0
Computer Associates Unicenter MQ Management 11.0
Computer Associates Unicenter Management for WebSphere 11.0
Computer Associates Unicenter Management for WebLogic 11.0
Computer Associates Unicenter Exchange Management 11.0
Computer Associates Unicenter CA Web Services Distributed Management 11.0
Computer Associates Unicenter AutoSys JM 11.0
Computer Associates Unicenter Asset Portfolio Management 11.0
Computer Associates Unicenter Application Server Managment 11.0
Computer Associates Unicenter Application Performance Monitor 11.0
Computer Associates Harvest Change Manager 7.1
Computer Associates eTrust Web Service Security 8.0
Computer Associates eTrust Secure Content Manager 8.0
Computer Associates eTrust Integrated Threat Management 8.0
Computer Associates eTrust Identity Minder 8.0
Computer Associates eTrust Audit iRecorders 8.0
Computer Associates eTrust Audit iRecorders 1.5 SP3
Computer Associates eTrust Audit iRecorders 1.5 SP2
Computer Associates eTrust Audit ARIES 8.0
Computer Associates eTrust Audit ARIES 1.5 SP3
Computer Associates eTrust Audit ARIES 1.5 SP2
Computer Associates eTrust Admin 8.1
Computer Associates eTrust Admin 8.0
Computer Associates BrightStor SRM 11.5
Computer Associates BrightStor SRM 11.1
Computer Associates BrightStor SRM 6.4
Computer Associates BrightStor SRM 6.3
Computer Associates BrightStor SAN Manager 11.5
Computer Associates BrightStor SAN Manager 11.1
Computer Associates BrightStor Process Automation Manager 11.1
Computer Associates BrightStor Portal 11.1
Computer Associates BrightStor Enterprise Backup 10.5
Computer Associates BrightStor ARCServe Backup for Windows 11.0
Computer Associates BrightStor ARCServe Backup 11.5
Computer Associates BrightStor ARCServe Backup 11.1
Computer Associates BrightStor ARCServe Backup 9.1
Computer Associates ARCserve Backup for Laptops and Desktops 11.1
Computer Associates ARCserve Backup for Laptops and Desktops 11.0
Computer Associates Advantage Data Transformer 2.2
Not Vulnerable:

Discussion

Computer Associates Multiple Product HTTP Request Remote Buffer Overflow Vulnerability

Multiple Computer Associates products are susceptible to a remote buffer overflow vulnerability. This issue is due to a failure of the affected products to properly bounds check user-supplied data prior to copying it to an insufficiently sized memory buffer.

This issue exists in the iTechnology iGateway component that is included in multiple Computer Associates products.

Versions 1.x, 2.x, and the current 4.x versions of the iGateway component are not affected by this issue. Version 3.0.040107 and earlier 3.x versions are affected. This issue is only exploitable if the non-default components are installed, the 'igateway.conf' configuration file has debugging enabled, and the service is then manually restarted.

This issue allows remote attackers to execute arbitrary machine code in the context of affected applications.

Exploit / POC

Computer Associates Multiple Product HTTP Request Remote Buffer Overflow Vulnerability

An exploit by EMendoza <[email protected]> is available. This exploit has not been verified by Symantec.

Solution / Fix

Computer Associates Multiple Product HTTP Request Remote Buffer Overflow Vulnerability

Solution:
An update of Computer Associates advisory CAID 33485 is available with fixes for this issue.


Computer Associates ARCserve Backup for Laptops and Desktops 11.0

Computer Associates ARCserve Backup for Laptops and Desktops 11.1

Computer Associates eTrust Audit ARIES 1.5 SP3

Computer Associates eTrust Audit iRecorders 1.5 SP2

Computer Associates eTrust Audit iRecorders 1.5 SP3

Computer Associates eTrust Audit ARIES 1.5 SP2

Computer Associates BrightStor Enterprise Backup 10.5

Computer Associates Unicenter Service Level Management 11.0

Computer Associates Unicenter Service Delivery 11.0

Computer Associates Unicenter Management for WebLogic 11.0

Computer Associates Unicenter Service Desk 11.0

Computer Associates Unicenter MQ Management 11.0

Computer Associates Unicenter Asset Portfolio Management 11.0

Computer Associates Unicenter Service Desk Knowledge Tools 11.0

Computer Associates BrightStor ARCServe Backup for Windows 11.0

Computer Associates Unicenter Service Catalog/Fulfillment/Accounting 11.0

Computer Associates Unicenter Management for WebSphere 11.0

Computer Associates Unicenter Application Performance Monitor 11.0

Computer Associates Unicenter Exchange Management 11.0

Computer Associates Unicenter AutoSys JM 11.0

Computer Associates Unicenter Service Matrix Analysis 11.0

Computer Associates Unicenter Service Fulfillment 11.0

Computer Associates Unicenter Web Server Management 11.0

Computer Associates Unicenter CA Web Services Distributed Management 11.0

Computer Associates Unicenter Application Server Managment 11.0

Computer Associates BrightStor SAN Manager 11.1

Computer Associates BrightStor Process Automation Manager 11.1

Computer Associates BrightStor SRM 11.1

Computer Associates BrightStor Portal 11.1

Computer Associates BrightStor ARCServe Backup 11.1

Computer Associates BrightStor SAN Manager 11.5

Computer Associates BrightStor SRM 11.5

Computer Associates BrightStor ARCServe Backup 11.5

Computer Associates Unicenter Service Fulfillment 2.2

Computer Associates Advantage Data Transformer 2.2

Computer Associates BrightStor SRM 6.3

Computer Associates BrightStor SRM 6.4

Computer Associates Harvest Change Manager 7.1

Computer Associates eTrust Admin 8.0

Computer Associates eTrust Audit iRecorders 8.0

Computer Associates eTrust Secure Content Manager 8.0

Computer Associates eTrust Integrated Threat Management 8.0

Computer Associates eTrust Web Service Security 8.0

Computer Associates eTrust Identity Minder 8.0

Computer Associates eTrust Audit ARIES 8.0

Computer Associates eTrust Admin 8.1

Computer Associates BrightStor ARCServe Backup 9.1

References

Computer Associates Multiple Product HTTP Request Remote Buffer Overflow Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report