Stack-based buffer overflow in the Message Queuing Server (Cam.exe) in CA (formerly Computer Associates) Message Queuing (CAM / CAFT) software before 1.11 Build 54_4 on Windows and NetWare, as used in CA Advantage Data Transport, eTrust Admin, certain BrightStor products, certain CleverPath products, and certain Unicenter products, allows remote attackers to execute arbitrary code via a crafted message to TCP port 3104.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Advantage_data_transport | Broadcom | 3.0 (including) | 3.0 (including) |
| Brightstor_portal | Broadcom | 11.1 (including) | 11.1 (including) |
| Brightstor_san_manager | Broadcom | 11.1 (including) | 11.1 (including) |
| Brightstor_san_manager | Broadcom | 11.5 (including) | 11.5 (including) |
| Cleverpath_aion | Broadcom | 10.0 (including) | 10.0 (including) |
| Cleverpath_ecm | Broadcom | 3.5 (including) | 3.5 (including) |
| Cleverpath_olap | Broadcom | 5.1 (including) | 5.1 (including) |
| Cleverpath_predictive_analysis_server | Broadcom | 2.0 (including) | 2.0 (including) |
| Cleverpath_predictive_analysis_server | Broadcom | 3.0 (including) | 3.0 (including) |
| Etrust_admin | Broadcom | 8.0 (including) | 8.0 (including) |
| Etrust_admin | Broadcom | 8.1 (including) | 8.1 (including) |
| Unicenter_application_performance_monitor | Broadcom | 3.0 (including) | 3.0 (including) |
| Unicenter_application_performance_monitor | Broadcom | 3.5 (including) | 3.5 (including) |
| Unicenter_asset_management | Broadcom | 3.1 (including) | 3.1 (including) |
| Unicenter_asset_management | Broadcom | 3.2 (including) | 3.2 (including) |
| Unicenter_asset_management | Broadcom | 3.2-sp1 (including) | 3.2-sp1 (including) |
| Unicenter_asset_management | Broadcom | 3.2-sp2 (including) | 3.2-sp2 (including) |
| Unicenter_asset_management | Broadcom | 4.0 (including) | 4.0 (including) |
| Unicenter_data_transport_option | Broadcom | 2.0 (including) | 2.0 (including) |
| Unicenter_jasmine | Broadcom | 3.0 (including) | 3.0 (including) |
| Unicenter_network_and_systems_management | Broadcom | 3.0 (including) | 3.0 (including) |
| Unicenter_network_and_systems_management | Broadcom | 3.1 (including) | 3.1 (including) |
| Unicenter_nsm_wireless_network_management_option | Broadcom | 3.0 (including) | 3.0 (including) |
| Unicenter_remote_control | Broadcom | 6.0 (including) | 6.0 (including) |
| Unicenter_remote_control | Broadcom | 6.0-sp1 (including) | 6.0-sp1 (including) |
| Unicenter_service_level_management | Broadcom | 3.0 (including) | 3.0 (including) |
| Unicenter_service_level_management | Broadcom | 3.0.1 (including) | 3.0.1 (including) |
| Unicenter_service_level_management | Broadcom | 3.0.2 (including) | 3.0.2 (including) |
| Unicenter_service_level_management | Broadcom | 3.5 (including) | 3.5 (including) |
| Unicenter_software_delivery | Broadcom | 3.0 (including) | 3.0 (including) |
| Unicenter_software_delivery | Broadcom | 3.1 (including) | 3.1 (including) |
| Unicenter_software_delivery | Broadcom | 3.1-sp1 (including) | 3.1-sp1 (including) |
| Unicenter_software_delivery | Broadcom | 3.1-sp2 (including) | 3.1-sp2 (including) |
| Unicenter_software_delivery | Broadcom | 4.0 (including) | 4.0 (including) |
| Unicenter_tng | Broadcom | 2.1 (including) | 2.1 (including) |
| Unicenter_tng | Broadcom | 2.2 (including) | 2.2 (including) |
| Unicenter_tng | Broadcom | 2.4 (including) | 2.4 (including) |
| Unicenter_tng | Broadcom | 2.4.2 (including) | 2.4.2 (including) |
| Etrust_admin | Ca | 2.1 (including) | 2.1 (including) |
| Etrust_admin | Ca | 2.4 (including) | 2.4 (including) |
| Etrust_admin | Ca | 2.7 (including) | 2.7 (including) |
| Etrust_admin | Ca | 2.9 (including) | 2.9 (including) |
| Unicenter_asset_management | Ca | 4.0-sp1 (including) | 4.0-sp1 (including) |
| Unicenter_enterprise_job_manager | Ca | 1.0-sp1 (including) | 1.0-sp1 (including) |
| Unicenter_enterprise_job_manager | Ca | 1.0-sp2 (including) | 1.0-sp2 (including) |
| Unicenter_management | Ca | 4.0 (including) | 4.0 (including) |
| Unicenter_management | Ca | 4.1 (including) | 4.1 (including) |
| Unicenter_management | Ca | 5.0 (including) | 5.0 (including) |
| Unicenter_management | Ca | 5.0.1 (including) | 5.0.1 (including) |
| Unicenter_software_delivery | Ca | 4.0-sp1 (including) | 4.0-sp1 (including) |
| Unicenter_tng | Ca | 2.2 (including) | 2.2 (including) |
References
- http://secunia.com/advisories/26190
- http://supportconnectw.ca.com/public/dto_transportit/infodocs/camsgquevul-secnot.asp
- http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=149809
- http://www.iss.net/threats/272.html
- http://www.securityfocus.com/archive/1/474602/100/0/threaded
- http://www.securityfocus.com/bid/25051
- http://www.securitytracker.com/id?1018449
- http://www.vupen.com/english/advisories/2007/2638
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32234
- http://secunia.com/advisories/26190
- http://supportconnectw.ca.com/public/dto_transportit/infodocs/camsgquevul-secnot.asp
- http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=149809
- http://www.iss.net/threats/272.html
- http://www.securityfocus.com/archive/1/474602/100/0/threaded
- http://www.securityfocus.com/bid/25051
- http://www.securitytracker.com/id?1018449
- http://www.vupen.com/english/advisories/2007/2638
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32234