Description
Multiple buffer overflows in Computer Associates (CA) License Client and Server 0.1.0.15 allow remote attackers to execute arbitrary code via (1) certain long fields in the Checksum item in a GCR request, (2) a long IP address, hostname, or netmask values in a GCR request, (3) a long last parameter in a GETCONFIG packet, or (4) long values in a request with an invalid format.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 3 modules
-
CA BrightStor ARCserve License Service GCR NETWORK Buffer Overflow
exploit/windows/brightstor/license_gcr
-
Computer Associates License Client GETCONFIG Overflow
exploit/windows/license/calicclnt_getconfig
-
Computer Associates License Server GETCONFIG Overflow
exploit/windows/license/calicserv_getconfig
Exploit-DB 4
- CA BrightStor ARCserve License Service - 'GCR NETWORK' Remote Buffer Overflow (Metasploit) EDB-16414 · remote · Nov 3, 2010 · verified
- Computer Associates License Client - GETCONFIG Overflow (Metasploit) EDB-16744 · remote · Sep 20, 2010 · verified
- Computer Associates License Server - GETCONFIG Overflow (Metasploit) EDB-16745 · remote · Sep 20, 2010 · verified
- CA License Server - 'GETCONFIG' Remote Buffer Overflow EDB-859 · remote · Mar 6, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20050302 License Patches Are Now Available To Address Buffer Overflows mailing-list
- 20050302 Computer Associates License Client and Server Invalid Command Buffer Overflow third-party-advisory
- 20050302 Computer Associates License Client/Server GCR Checksum Buffer Overflow third-party-advisory
- 20050302 Computer Associates License Client/Server GETCONFIG Buffer Overflow third-party-advisory
- http://supportconnectw.ca.com/public/ca_common_docs/security_notice.asp
- 20050302 Computer Associates License Client/Server GCR Network Buffer Overflow third-party-advisory