Computer Associates Anti-Virus Engine 'arclib.dll' Multiple Scan Evasion Vulnerabilities

Bugtraq ID:	33464
Class:	Input Validation Error
CVE:	CVE-2009-0042
Remote:	Yes
Local:	No
Published:	Jan 27 2009 12:00AM
Updated:	May 12 2009 10:06PM
Credit:	Thierry Zoller and Sergio Alvarez of n.runs AG
Vulnerable:	Computer Associates Unicenter Network and Systems Management 3.1 Computer Associates Unicenter Network and Systems Management 3.0 Computer Associates Unicenter Network and Systems Management 12.0 Computer Associates Unicenter Network and Systems Management 11.1 Computer Associates Unicenter Network and Systems Management 11 Computer Associates Threat Manager for the Enterprise r8.1 Computer Associates Threat Manager for the Enterprise r8 Computer Associates Protection Suites r2 0 Computer Associates Protection Suites r3 Computer Associates Protection Suites 3.1 Computer Associates Internet Security Suite 2008 Plus 0 Computer Associates Internet Security Suite 2008 0 Computer Associates Internet Security Suite 2007 3.0 Computer Associates Gateway Security 8.1 Computer Associates eTrust Secure Content Manager 8.0 Computer Associates eTrust Secure Content Manager 1.1 Computer Associates eTrust Secure Content Manager 8.1 Computer Associates eTrust Intrusion Detection 3.0 SP 1 Computer Associates eTrust Intrusion Detection 3.0 Computer Associates eTrust Intrusion Detection 4.0 Computer Associates eTrust Intrusion Detection 2.0.0 SP1 Computer Associates eTrust EZ Antivirus 7.1 Computer Associates eTrust Antivirus 7.0 Computer Associates eTrust Antivirus r8.1 Computer Associates eTrust Antivirus r8 Computer Associates Common Services r11.1 Computer Associates Common Services r11 Computer Associates Common Services 3.1 Computer Associates BrightStor ARCServe Backup for Windows 11.5 Computer Associates BrightStor ARCServe Backup for Windows 11.1 Computer Associates BrightStor ARCServe Backup for Windows 11.0 Computer Associates BrightStor ARCServe Backup for Windows 12.0 Computer Associates BrightStor ARCServe Backup for Linux 11.1 Computer Associates BrightStor ARCServe Backup for Linux 11.5 Computer Associates ARCserve for Windows Server component 0 Computer Associates ARCServe Client agent for Windows 0 Computer Associates ARCServe 12.0 Computer Associates Anti-Virus SDK 0 Computer Associates Anti-Virus Gateway 7.1 Computer Associates Anti-Spyware for the Enterprise r8.1 Computer Associates Anti-Spyware for the Enterprise r8 Computer Associates Anti-Spyware 2008 0 Computer Associates Anti-Spyware 2007
Not Vulnerable:

Computer Associates Anti-Virus Engine 'arclib.dll' Multiple Scan Evasion Vulnerabilities

Computer Associates Anti-Virus engine is prone to multiple vulnerabilities that may allow certain compressed archives to bypass the scan engine.

Successful exploits will allow attackers to distribute files containing malicious code that the antivirus engine will fail to detect.

Products with 'arclib.dll' prior to version 7.3.0.15 are vulnerable.

Computer Associates Anti-Virus Engine 'arclib.dll' Multiple Scan Evasion Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Computer Associates Anti-Virus Engine 'arclib.dll' Multiple Scan Evasion Vulnerabilities

Solution:
The vendor released an update to address this issue. Please see the references for more information.

Computer Associates Anti-Virus Engine 'arclib.dll' Multiple Scan Evasion Vulnerabilities

References:

• CA20090126-01: Security Notice for CA Anti-Virus Engine (Computer Associates Homepage)
  
• Computer Associates Homepage (Computer Associates)
  
• CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities ('Williams, James K' )
  
• CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities [ ("Williams, James K" )