Computer Associates eTrust Antivirus EE System Account Lockout Vulnerability
BID:8448
Info
Computer Associates eTrust Antivirus EE System Account Lockout Vulnerability
| Bugtraq ID: | 8448 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 28 2003 12:00AM |
| Updated: | Jun 28 2003 12:00AM |
| Credit: | Discovery is credited to Geoff Vass. |
| Vulnerable: |
Computer Associates eTrust Antivirus EE 7.0 |
| Not Vulnerable: | |
Discussion
Computer Associates eTrust Antivirus EE System Account Lockout Vulnerability
A vulnerability has been reported in Computer Associates eTrust Antivirus EE. Under some circumstances, access to system resources such as system accounts and system processes for authentication may be restricted when the Realtime Monitor detects a virus, causing the NT Local System account to be quarantined.
The condition is likely to occur when the software is deployed with the e-mail add-on for Exchange. When files are scanned, they will first be saved to the local system and subsequently detected by the Realtime Monitor. eTrust will proceed to scan and clean the file, but the Realtime Monitor has already flagged it as malicious and quarantined the system account. This condition will persist until the quarantine expires.
A vulnerability has been reported in Computer Associates eTrust Antivirus EE. Under some circumstances, access to system resources such as system accounts and system processes for authentication may be restricted when the Realtime Monitor detects a virus, causing the NT Local System account to be quarantined.
The condition is likely to occur when the software is deployed with the e-mail add-on for Exchange. When files are scanned, they will first be saved to the local system and subsequently detected by the Realtime Monitor. eTrust will proceed to scan and clean the file, but the Realtime Monitor has already flagged it as malicious and quarantined the system account. This condition will persist until the quarantine expires.
Exploit / POC
Computer Associates eTrust Antivirus EE System Account Lockout Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
Computer Associates eTrust Antivirus EE System Account Lockout Vulnerability
Solution:
Computer Associates has released a patch on their eSupport website. This patch is available to customers with a support contract.
Computer Associates eTrust Antivirus EE 7.0
Solution:
Computer Associates has released a patch on their eSupport website. This patch is available to customers with a support contract.
Computer Associates eTrust Antivirus EE 7.0
-
Computer Associates QO41975
http://esupport.ca.com/premium/antivirus/downloads/nt/7.0/QO41975.asp
References
Computer Associates eTrust Antivirus EE System Account Lockout Vulnerability
References:
References:
- eSupport Homepage (Computer Associates)