CA eTrust Antivirus WebScan Remote Buffer Overflow Vulnerability

Bugtraq ID:	19351
Class:	Boundary Condition Error
CVE:	CVE-2006-3975
Remote:	Yes
Local:	No
Published:	Aug 04 2006 12:00AM
Updated:	Aug 08 2006 07:35PM
Credit:	Matt Murphy of Tipping Point discovered this issue.
Vulnerable:	Computer Associates eTrust Antivirus WebScan 1.1.0.1047
Not Vulnerable:	Computer Associates eTrust Antivirus WebScan 1.1.0.1048

CA eTrust Antivirus WebScan Remote Buffer Overflow Vulnerability

CA eTrust Antivirus WebScan is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Due to improper validation of user-supplied input, a remote attacker may cause a buffer-overflow condition and may also execute arbitrary code in the context of the user running the affected application.

This issue affects version 1.1.0.1047 and earlier; other versions may also be affected.

CA eTrust Antivirus WebScan Remote Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

CA eTrust Antivirus WebScan Remote Buffer Overflow Vulnerability

Solution:
The vendor has released version 1.1.0.1048 to address this issue; please see the references for vendor advisories and more information.


Computer Associates eTrust Antivirus WebScan 1.1.0.1047

• Computer Associates scan.aspx
  http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

CA eTrust Antivirus WebScan Remote Buffer Overflow Vulnerability

References:

• [Full-disclosure] TSRT-06-06: Computer Associates eTrust AntiVirus WebScan Manif (Tipping Point)
  
• Computer Associates Web Site (Computer Associates)
  
• CAID 34509 - CA eTrust Antivirus WebScan vulnerabilities ("Williams, James K" )