Computer Associates Virus Definition Downgrade Vulnerability

Bugtraq ID:	19399
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 07 2006 12:00AM
Updated:	Mar 08 2007 12:05AM
Credit:	Discovery is credited to Matthew Murphy of the TippingPoint Security Research Team.
Vulnerable:	Computer Associates eTrust Antivirus WebScan 1.1.0.1047 Computer Associates eTrust Antivirus WebScan 1.1.0.1045
Not Vulnerable:	Computer Associates eTrust Antivirus WebScan 1.1.0.1048

Computer Associates Virus Definition Downgrade Vulnerability

A flaw in the Computer Associates WebScan product reportedly could cause the application's virus definitions to be downgraded to a previous version.

This presents a security risk because the virus definitions in question may be out of date and may not effectively detect newer variants of malicious code.

Computer Associates Virus Definition Downgrade Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Computer Associates Virus Definition Downgrade Vulnerability

Solution:
The vendor has released version 1.1.0.1048 to address this issue; please see the reference section for details.

Computer Associates Virus Definition Downgrade Vulnerability

References:

• CA 34509 : CA eTrust Antivirus WebScan multiple vulnerabilities (Computer Associates)
  
• Computer Associates Web Site (Computer Associates)
  
• TippingPoint Advisory TSRT-06-05 (TippingPoint)
  
• TSRT-06-05: Computer Associates eTrust AntiVirus WebScan Automatic Update Code E ([email protected])