Description
Heap-based buffer overflow in the iGateway service for various Computer Associates (CA) iTechnology products, in iTechnology iGateway before 4.0.051230, allows remote attackers to execute arbitrary code via an HTTP request with a negative Content-Length field.
Affected products
- Broadcom / brightstor_arcserve_backup9.01 – 9.01
- Broadcom / brightstor_arcserve_backup11.1 – 11.1
- Broadcom / brightstor_arcserve_backup11.5 – 11.5
- Broadcom / brightstor_arcserve_backup_laptops_desktops11.0 – 11.0
- Broadcom / brightstor_arcserve_backup_laptops_desktops11.1 – 11.1
- Broadcom / brightstor_portal11.1 – 11.1
- Broadcom / brightstor_process_automation_manager11.1 – 11.1
- Broadcom / brightstor_san_manager11.1 – 11.1
- Broadcom / brightstor_san_manager11.5 – 11.5
- Broadcom / brightstor_storage_resource_manager6.3 – 6.3
- Broadcom / brightstor_storage_resource_manager6.4 – 6.4
- Broadcom / brightstor_storage_resource_manager11.1 – 11.1
- Broadcom / brightstor_storage_resource_manager11.5 – 11.5
- Broadcom / etrust_admin8.1 – 8.1
- Broadcom / etrust_audit_aries8.0 – 8.0
- Broadcom / etrust_audit_irecorder1.5 – 1.5
- Broadcom / etrust_audit_irecorder1.5 – 1.5
- Broadcom / etrust_audit_irecorder8.0 – 8.0
- Broadcom / etrust_identity_minder8.0 – 8.0
- Broadcom / etrust_integrated_threat_management8.0 – 8.0
- Broadcom / itechnology_igateway4.0.050615
- Broadcom / unicenter_asset_portfolio_management11.0 – 11.0
- Broadcom / unicenter_autosys_jm11.0 – 11.0
- Broadcom / unicenter_service_delivery11.0 – 11.0
- Broadcom / unicenter_service_desk11.0 – 11.0
- Broadcom / unicenter_service_desk_knowledge_tools11.0 – 11.0
- Broadcom / unicenter_service_fulfillment2.2 – 2.2
- Broadcom / unicenter_service_metric_analysis11.0 – 11.0
- ca / brightstor_arcserve_backup11 – 11
- ca / brightstor_enterprise_backup10.0 – 10.0
- ca / brightstor_enterprise_backup10.5 – 10.5
- ca / brightstor_enterprise_backup10.5 – 10.5
- ca / brightstor_enterprise_backup10.5 – 10.5
- ca / etrust_audit_aries1.5 – 1.5
- ca / etrust_audit_aries1.5 – 1.5
- ca / etrust_directory8.1_web_components – 8.1_web_components
- ca / etrust_secure_content_manager8.0 – 8.0
- ca / unicenter_application_performance_monitor11.0 – 11.0
- ca / unicenter_application_server_managment11.0 – 11.0
- ca / unicenter_ca_web_services_distributed_management11.0 – 11.0
- ca / unicenter_exchange_management_console11.0 – 11.0
- ca / unicenter_management3.5 – 3.5
- ca / unicenter_management11.0 – 11.0
- ca / unicenter_management11.0 – 11.0
- ca / unicenter_service_catalog_fulfillment_accounting11.0 – 11.0
- ca / unicenter_service_fulfillment11.0 – 11.0
- ca / unicenter_service_level_management11.0 – 11.0
- ca / unicenter_web_server_management11.0 – 11.0
- ca / unicenter_web_services_distributed_management11.0 – 11.0
References
- MISChttp://securitytracker.com/id?1015526
- MAILING_LISThttp://marc.info/?l=full-disclosure&m=113803349715927&w=2
- MISChttp://www.osvdb.org/22688
- VENDOR_ADVISORYhttp://secunia.com/advisories/18591
- MISChttp://www.securityfocus.com/bid/16354
- MISChttp://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33778
- MISChttp://securityreason.com/securityalert/380
- MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/24269
- VENDOR_ADVISORYhttp://www.vupen.com/english/advisories/2006/0311
- MISChttp://www.securityfocus.com/archive/1/423288/100/0/threaded
- MISChttp://www.idefense.com/intelligence/vulnerabilities/display.php?id=376
- MISChttp://www.securityfocus.com/archive/1/423403/100/0/threaded
- MISChttp://supportconnectw.ca.com/public/ca_common_docs/igatewaysecurity_notice.asp