Description
Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, and eTrust Audit 1.5 and r8, allows remote attackers to spoof alerts and conduct replay attacks by invoking eTSAPISend.exe with the desired arguments.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- CA eSCC r8/1.0 / eTrust Audit r8/1.5 - Audit Event System Replay Attack EDB-28642 · remote · Sep 21, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://users.tpg.com.au/adsl2dvp/advisories/200608-computerassociates.txt
- ca-etrust-alert-replay(29107) vdb-entry
- http://www3.ca.com/securityadvisor/blogs/posting.aspx?id=90744&pid=93243&date=2006/9
- 1016910 vdb-entry
- http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34618
- 22023 third-party-advisory
- 20139 vdb-entry
- 20060922 RE: Computer Associates eTrust Security Command Center Multiple Vulnerabilities mailing-list
- 22073 third-party-advisory
- 1016909 vdb-entry
- 20060921 [CAID 34616, 34617, 34618]: CA eSCC and eTrust Audit vulnerabilities mailing-list
- ADV-2006-3738 vdb-entry
- 29011 vdb-entry