Check Point Advisories

CA Multiple Products HTTP Request Buffer Overflow (CVE-2005-3190)

Vulnerability
Protection

Check Point Reference:	CPAI-2005-310
Date Published:	17 Mar 2010
Severity:	Critical
Last Updated:	Wednesday 17 March, 2010
Source:
Industry Reference:	CVE-2005-3190
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	The Computer Associates (CA) BrightStor backup server product line provides facilities for integration with third party software and hardware products to consolidate storage management tasks. CA uses an XML-based interface named iSponsor/iGateway to integrate with storage management applications from other vendors. A buffer overflow vulnerability has been reported in the CA iGateway that is bundled with multiple Computer Associates products. The vulnerability is caused by insufficient validation performed on the length of HTTP requests. A remote attacker may exploit this vulnerability to create a denial of service condition or execute arbitrary code on the target system. In a simple attack case aimed at creating a denial of service condition, the affected service will terminate. In a more sophisticated attack scenario, where the malicious user is successful in injecting and executing supplied code, the behavior of the system is dependent on the nature the injected code. Any code injected into the vulnerable component would execute in the security context of the iGateway process.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the CA Multiple Products HTTP Request Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: CA Products Enforcement Violation.
Attack Information: CA Multiple Products HTTP Request Buffer Overflow