CA Host-Based Intrusion Prevention System 'XMLSecDB' ActiveX Control Code Execution Vulnerability

Bugtraq ID:	46539
Class:	Input Validation Error
CVE:	CVE-2011-1036
Remote:	Yes
Local:	No
Published:	Feb 23 2011 12:00AM
Updated:	Feb 25 2011 02:28PM
Credit:	Andrea Micalizzi aka rgod
Vulnerable:	Computer Associates Internet Security Suite 2011 Computer Associates Internet Security Suite 2010 Computer Associates Host-Based Intrusion Prevention System R8.1
Not Vulnerable:

CA Host-Based Intrusion Prevention System 'XMLSecDB' ActiveX Control Code Execution Vulnerability

CA Host-Based Intrusion Prevention System(HIPS) is prone to a remote code-execution vulnerability.

An attacker can exploit this vulnerability to execute arbitrary code in the context of the logged-in user. Failed exploits result in denial-of-service conditions.

Internet Security Suite 2008 is vulnerable; other versions may also be affected.

CA Host-Based Intrusion Prevention System 'XMLSecDB' ActiveX Control Code Execution Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into viewing a malicious web page.

CA Host-Based Intrusion Prevention System 'XMLSecDB' ActiveX Control Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more details.

CA Host-Based Intrusion Prevention System 'XMLSecDB' ActiveX Control Code Execution Vulnerability

References:

• CA Internet Security Suite HIPS XML Security Database Parser Class Remote Code E (TippingPoint Zero Day Initiative)
  
• Computer Associates Homepage (Computer Associates)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• CA20110223-01: Security Notice for CA Host-Based Intrusion Prevention System (Computer Associates)