[guru] CA biztonsagi frissitesek
DATE: Mon, 26 Oct 2009 22:36:07 +0100
A CA Anti-Virus Engine arclib komponense hibásan kezeli a RAR állományokat,
a feldolgozás közben stack és heap overflow hiba lép fel.
--- Begin Message ---
CA20091008-01: Security Notice for CA Anti-Virus Engine
Issued: October 8, 2009
CA's support is alerting customers to multiple security risks
associated with CA Anti-Virus Engine. Vulnerabilities exist in
the arclib component that can allow a remote attacker to cause a
denial of service, or to cause heap corruption and potentially
further compromise a system. CA has issued fixes to address the
vulnerabilities.
The first vulnerability, CVE-2009-3587, is due to improper
handling of a specially crafted RAR archive file by the CA
Anti-Virus engine arclib component. An attacker can create a
malformed RAR archive file that results in heap corruption and
allows the attacker to cause a denial of service or possibly
further compromise the system.
The second vulnerability, CVE-2009-3588, is due to improper
handling of a specially crafted RAR archive file by the CA
Anti-Virus engine arclib component. An attacker can create a
malformed RAR archive file that results in stack corruption and
allows the attacker to cause a denial of service.
Risk Rating
Medium
Platform
Windows
UNIX
Linux
Solaris
Mac OS X
Netware
Affected Products
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) r8
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) r8.1
CA Anti-Virus 2007 (v8)
CA Anti-Virus 2008
CA Anti-Virus 2009
CA Anti-Virus Plus 2009
eTrust EZ Antivirus r7.1
CA Internet Security Suite 2007 (v3)
CA Internet Security Suite 2008
CA Internet Security Suite Plus 2008
CA Internet Security Suite Plus 2009
CA Threat Manager for the Enterprise (formerly eTrust Integrated
Threat Management) r8
CA Threat Manager for the Enterprise (formerly eTrust Integrated
Threat Management) 8.1
CA Threat Manager Total Defense
CA Gateway Security r8.1
CA Protection Suites r2
CA Protection Suites r3
CA Protection Suites r3.1
CA Secure Content Manager (formerly eTrust Secure Content
Manager) 1.1
CA Secure Content Manager (formerly eTrust Secure Content
Manager) 8.0
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r3.0
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r3.1
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r11
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r11.1
CA ARCserve Backup r11.5 on Windows
CA ARCserve Backup r12 on Windows
CA ARCserve Backup r12.0 SP1 on Windows
CA ARCserve Backup r12.0 SP 2 on Windows
CA ARCserve Backup r12.5 on Windows
CA ARCserve Backup r11.1 Linux
CA ARCserve Backup r11.5 Linux
CA ARCserve for Windows Client Agent
CA ARCserve for Windows Server component
CA eTrust Intrusion Detection 2.0 SP1
CA eTrust Intrusion Detection 3.0
CA eTrust Intrusion Detection 3.0 SP1
CA Common Services (CCS) r3.1
CA Common Services (CCS) r11
CA Common Services (CCS) r11.1
CA Anti-Virus SDK (formerly eTrust Anti-Virus SDK)
CA Anti-Virus Gateway (formerly eTrust Antivirus Gateway) 7.1
Non-Affected Products
CA Anti-Virus engine with arclib version 8.1.4.0 or later
installed
How to determine if the installation is affected
For products on Windows:
1. Using Windows Explorer, locate the file "arclib.dll". By
default, the file is located in the
"C:\Program Files\CA\SharedComponents\ScanEngine" directory (*).
2. Right click on the file and select Properties.
3. Select the Version tab.
4. If the file version is earlier than indicated below, the
installation is vulnerable.
File Name File Version
arclib.dll 8.1.4.0
*For eTrust Intrusion Detection 2.0, the file is located in
"Program Files\eTrust\Intrusion Detection\Common", and for eTrust
Intrusion Detection 3.0 and 3.0 sp1, the file is located in
"Program Files\CA\Intrusion Detection\Common".
For CA Anti-Virus r8.1 on non-Windows platforms:
Use the compver utility provided on the CD to determine the
version of Arclib. If the version is less than 8.1.4.0, the
installation is vulnerable.
Example compver utility output:
------------------------------------------------
COMPONENT NAME VERSION
------------------------------------------------
eTrust Antivirus Arclib Archive Library 8.1.4.0
... (followed by other components)
For reference, the following are file names for arclib on
non-Windows operating systems:
Operating System File name
Solaris libarclib.so
Linux libarclib.so
Mac OS X arclib.bundle
Solution
CA released arclib 8.1.4.0 on August 12 2009. If your product is
configured for automatic updates, you should already be protected,
and you need to take no action. If your product is not configured
for automatic updates, then you simply need to run the update
utility included with your product.
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r3.0: apply fix # RO11964.
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r3.1: apply fix # RO11964.
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r11: apply fix # RO11964.
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r11.1: apply fix # RO11964.
CA Common Services (CCS) r3.1: apply fix # RO11954.
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1
32bit: apply fix # RO10663.
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1
IA64: apply fix # RO10664.
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1
AMD64: apply fix # RO10665.
CA Secure Content Manager (formerly eTrust Secure Content Manager)
r1.1: apply fix # RO10999.
CA Secure Content Manager (formerly eTrust Secure Content Manager)
r8.0: apply fix # RO10999.
CA Anti-Virus Gateway (formerly eTrust Antivirus Gateway) 7.1:
apply fix # RO11000.
CA Gateway Security r8.1: RO10999.
CA ARCserve for Windows Server component installed on a 64 bit
machine: apply fixes # RO10663 and RO10664 (IA64) or RO10665
(AMD64).
CA ARCserve for Windows Server component installed on a 32 bit
machine: apply fix # RO10663.
CA ARCserve for Windows Client Agent installed on a 64 bit
machine: apply fix # RO10664 (IA64) or RO10665 (AMD64).
CA ARCserve for Windows Client Agent installed on a 32 bit
machine: apply fix # RO10663.
CA ARCserve for Linux Server r11.5: apply fix # RO10729.
CA ARCserve for Linux:
1. Download RO10729.tar.Z from RO10729 into a temporary location
/tmp/RO10729
2. Uncompress and untar RO10729.tar.Z as follows:
uncompress RO10729.tar.Z
tar -xvf RO10729.tar
The new "libarclib.so" will be extracted to /tmp/RO10729
3. Change the directory to $CAIGLBL0000/ino/config as follows:
cd $CAIGLBL0000/ino/config
4. Rename "libarclib.so" to "libarclib.so.RO10729" as follows:
mv libarclib.so libarclib.so.RO10729
5. Copy the new libarclib.so as follows:
cp /tmp/RO10729/libarclib.so $CAIGLBL0000/ino/config/
6. chmod +x $CAIGLBL0000/ino/config/libarclib.so
7. Stop the common agent (caagent stop)
8. Change the directory to ARCserve common agent directory
(typically /opt/CA/BABcmagt)
cd /opt/CA/BABcmagt
Note: To find out the agent home directory run the following
command:
dirname 'ls -l /usr/bin/caagent |cut -f2 -d">"'
9. Save a copy of libarclib.so
cp -p libarclib.so libarclib.so.RO10729
10. Copy over the new libarclib.so as follows:
cp $/tmp/RO10729/libarclib.so.
11. Start the common agent (caagent start)
12. Repeat steps (7-11) on all remote Linux client agents'
installations.
13. rm -rf /tmp/RO10729
Workaround
Do not open email attachments or download files from untrusted
sources.
References
CVE-2009-3587 - CA Anti-Virus RAR archive heap corruption
CVE-2009-3588 - CA Anti-Virus RAR archive stack corruption
CA20091008-01: Security Notice for CA Anti-Virus Engine
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=218878
Acknowledgement
CVE-2009-3587 - Thierry Zoller - G-SEC - www.g-sec.lu
CVE-2009-3588 - Thierry Zoller - G-SEC - www.g-sec.lu
Change History
Version 1.0: Initial Release
Version 1.1: Updated list of affected products; added workaround.
If additional information is required, please contact CA Support
at http://support.ca.com/.
If you discover a vulnerability in CA products, please report your
findings to the CA Product Vulnerability Response Team.
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782
Regards,
Ken Williams, Director ; 0xE2941985
CA Product Vulnerability Response Team
CA, 1 CA Plaza, Islandia, NY 11749
Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2009 CA. All rights reserved.
--- End Message ---
--- Begin Message ---
________________________________________________________________________
Computer Associates (CA) Anti-Virus
Multiple products - arbitrary code execution
________________________________________________________________________
Release mode : Coordinated
Reference : [GSEC-46-2009] - Computer Associates multiple products RCE
WWW : http://blog.g-sec.lu/2009/10/computer-associates-multiple-products.html
Vendor : http://www.ca.com
Status : Patched
CVE : CVE-2009-3587 & CVE-2009-3588
Credit : https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=218878
Discovered by : Thierry Zoller (G-SEC)
Vendor reaction rating : near perfect*
*
Continous feedback on progress - CVE numbers - In depth investigation of the issues at hand
Affected products :
~~~~~~~~~~~~~~~~~~~
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) r8
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) r8.1
CA Anti-Virus 2007 (v8)
CA Anti-Virus 2008
CA Anti-Virus 2009
CA Anti-Virus Plus 2009
eTrust EZ Antivirus r7.1
CA Internet Security Suite 2007 (v3)
CA Internet Security Suite 2008
CA Internet Security Suite Plus 2008
CA Internet Security Suite Plus 2009
CA Threat Manager for the Enterprise (formerly eTrust Integrated
Threat Management) r8
CA Threat Manager for the Enterprise (formerly eTrust Integrated
Threat Management) 8.1
CA Threat Manager Total Defense
CA Gateway Security r8.1
CA Protection Suites r2
CA Protection Suites r3
CA Protection Suites r3.1
CA Secure Content Manager (formerly eTrust Secure Content
Manager) 1.1
CA Secure Content Manager (formerly eTrust Secure Content
Manager) 8.0
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r3.0
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r3.1
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r11
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r11.1
CA ARCserve Backup r11.5 on Windows
CA ARCserve Backup r12 on Windows
CA ARCserve Backup r12.0 SP1 on Windows
CA ARCserve Backup r12.0 SP 2 on Windows
CA ARCserve Backup r12.5 on Windows
CA ARCserve Backup r11.1 Linux
CA ARCserve Backup r11.5 Linux
CA ARCserve for Windows Client Agent
CA ARCserve for Windows Server component
CA eTrust Intrusion Detection 2.0 SP1
CA eTrust Intrusion Detection 3.0
CA eTrust Intrusion Detection 3.0 SP1
CA Common Services (CCS) r3.1
CA Common Services (CCS) r11
CA Common Services (CCS) r11.1
CA Anti-Virus SDK (formerly eTrust Anti-Virus SDK)
CA Anti-Virus Gateway (formerly eTrust Antivirus Gateway) 7.1
Affected Plattforms:
~~~~~~~~~~~~~~~~~~~
Windows
UNIX
Linux
Solaris
Mac OS X
Netware
Patch availability :
~~~~~~~~~~~~~~~~~~~~
Patches have been available since the 09.10.2009 - Please follow the steps listed
here: https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=218878
I. Background
~~~~~~~~~~~~~
Quote:
"CA is one of the world's largest IT management software providers.
We serve more than 99% of Fortune 1000 companies, as well as government
entities, educational institutions and thousands of other companies
in diverse industries worldwide"
"CA Anti-Virus for the Enterprise is the next generation in comprehensive
anti-virus security for business PCs, servers and PDAs. It combines
proactive protection against malware with new, powerful management
features that stop and remove malicious code before it enters your
network, reducing system downtime"
II. Description
~~~~~~~~~~~~~~~
Improper handling of a specially crafted RAR archive file by the CA
Anti-Virus engine arclib component leads to heap corruption and
allows the attacker to cause a denial of service or possibly
further compromise the system.
Attacker has control over EBX :
Basic Block:
6e4305b0 mov cl,byte ptr [ebx]
Tainted Input Operands: ebx
6e4305b2 add edi,28h
6e4305b5 push edi
6e4305b6 lea edx,[esp+14h]
6e4305ba mov byte ptr [esp+14h],cl
Tainted Input Operands: cl
6e4305be inc ebx
Tainted Input Operands: ebx
6e4305bf push edx
6e4305c0 mov ecx,esi
6e4305c2 mov dword ptr [esp+1ch],ebx
Tainted Input Operands: ebx
6e4305c6 call arclib!arctkopenarchive+0x283a0 (6e42f9f0)
III. Impact
~~~~~~~~~~~
The impact ranges from Denial of Service to potential remote arbitrary code execution.
Due to the nature of Anti-virus products, the attack vectors can be near endless. An attack
could be done over the way of an E-mail message carrying an RAR attachment (of a file
recognised as being RAR), USB, CD, Network data etc.
Please note that this is a general problem and not exclusive to Computer Associates.
IV. Disclosure timeline
~~~~~~~~~~~~~~~~~~~~~~~~~
DD.MM.YYYY
11.05.2009 - Reported CVE-2009-3587
03.06.2009 - Reported CVE-2009-3588
09.10.2009 - CA releases advisory
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=218878
13.10.2009 - G-SEC releases advisory
--- End Message ---