32919 - Computer Associates Message Queuing (CAM/CAFT) multiple vulnerabilities

From: Williams, James K (James.Williams_at_CA.COM)
Date: 08/22/05

Next message: Secunia Research: "Secunia Research: HAURI Anti-Virus ACE Archive Handling Buffer Overflow"

Previous message: Cooper, Russ: "Administrivia: Zotob/PnP Exploit Survey"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date:         Mon, 22 Aug 2005 16:08:02 -0400
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

Title: 32919 - Computer Associates Message Queuing (CAM/CAFT)
multiple vulnerabilities

CA Vulnerability ID: CAID 32919

Disclosure Date: 2005-08-19

Discovered By: CA internal audit

Impact: Remote attackers can execute arbitrary code, or cause a
denial of service condition.

Summary: During a recent internal audit, CA discovered several
vulnerability issues in the CA Message Queuing (CAM / CAFT)
software.

1) Attackers can potentially exploit a CAM TCP port vulnerability
to execute a Denial of Service (DoS) attack.

2) Attackers can potentially exploit multiple buffer overflow
conditions to execute arbitrary code remotely with elevated
privileges.

3) Attackers can potentially launch a spoofed CAFT attack, and
execute arbitrary commands with elevated privileges.

CA has made patches available for all affected users. These
vulnerabilities affect all versions of the CA Message Queuing
software prior to v1.07 Build 220_13 and v1.11 Build 29_13 on the
platforms specified below.

Severity: Computer Associates has given this vulnerability a High
risk rating.

Determining CAM versions:

Simply running camstat will return the version information in the
top line of the output on any platform. The camstat program is
located in the "bin" subfolder of the installation directory.

The example below indicates that CAM version 1.11 build 27
increment 2 is running.

E:\>camstat
CAM - machine.ca.com Version 1.11 (Build 27_2) up 0 days 1:16

Determining the CAM install directory:

Windows: the install location is specified by the %CAI_MSQ%
environment variable.

Unix/Linux/Mac: the /etc/catngcampath text file holds the CAM
install location.

Affected products:

Unicenter Performance Management for OpenVMS r2.4 SP3
AdviseIT 2.4
Advantage Data Transport 3.0
BrightStor SAN Manager 1.1, 1.1 SP1, 1.1 SP2, 11.1
BrightStor Portal 11.1
CleverPath OLAP 5.1
CleverPath ECM 3.5
CleverPath Predictive Analysis Server 2.0, 3.0
CleverPath Aion 10.0
eTrust Admin 2.01, 2.04, 2.07, 2.09, 8.0, 8.1
Unicenter Application Performance Monitor 3.0, 3.5
Unicenter Asset Management 3.1, 3.2, 3.2 SP1, 3.2 SP2, 4.0,
4.0 SP1
Unicenter Data Transport Option 2.0
Unicenter Enterprise Job Manager 1.0 SP1, 1.0 SP2
Unicenter Jasmine 3.0
Unicenter Management for WebSphere MQ 3.5
Unicenter Management for Microsoft Exchange 4.0, 4.1
Unicenter Management for Lotus Notes/Domino 4.0
Unicenter Management for Web Servers 5, 5.0.1
Unicenter NSM 3.0, 3.1
Unicenter NSM Wireless Network Management Option 3.0
Unicenter Remote Control 6.0, 6.0 SP1
Unicenter Service Level Management 3.0, 3.0.1, 3.0.2, 3.5
Unicenter Software Delivery 3.0, 3.1, 3.1 SP1, 3.1 SP2, 4.0,
4.0 SP1
Unicenter TNG 2.1, 2.2, 2.4, 2.4.2
Unicenter TNG JPN 2.2

Affected platforms:

AIX, DG Intel, DG Motorola, DYNIX, OSF1, HP-UX, IRIX,
Linux Intel, Linux s/390, Solaris Intel, Solaris Sparc, UnixWare,
Windows, Apple Mac, AS/400, MVS, NetWare, OS/2, and OpenVMS.

Status: Patches that completely remediate this vulnerability
issue are available for all affected products.

Recommendation (note that URLs may wrap):
CA strongly recommends application of the appropriate patch(es).

Customers wishing to patch their Master Image CD sets should
refer to the solution areas on the product home pages
(http://supportconnectw.ca.com/main.asp).

USD/SDO package for the CA Message Queuing vulnerability
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_faqs.asp
#faqsdo

UAM/AMO Definitions for the CA Message Queuing vulnerability
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_faqs.asp
#faqamo

CVE Reference: Pending

OSVDB Reference: Pending

Advisory URLs (note that URLs may wrap):

CA Message Queuing Security Notice
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_notice.a
sp

CA Security Advisor site: CAID 32919 - Computer Associates
Message Queuing (CAM/CAFT) multiple vulnerabilities
http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=32919

CA Message Queuing Security Notice Frequently Asked Questions
http://supportconnectw.ca.com/public/ca_common_docs/camsecurity_faqs.asp

Should you require additional information, please contact CA
Customer Support at http://supportconnect.ca.com.
CA Customer Support North America (individual product hotlines)
http://supportconnectw.ca.com/public/ca_common_docs/support_dir.pdf
CA International Customer Support (individual country offices)
http://www.ca.com/camap.htm

Respectfully,

Ken Williams ; Dir. Vuln Research
Computer Associates ; 0xE2941985

Computer Associates International, Inc. (CA).
One Computer Associates Plaza. Islandia, NY 11749

Contact Us http://ca.com/catalk.htm
Legal Notice http://ca.com/calegal.htm
Privacy Policy http://ca.com
Copyright 2005 Computer Associates International, Inc.
All rights reserved

--
NTBugtraq Editor's Note:
Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered.
--

Next message: Secunia Research: "Secunia Research: HAURI Anti-Virus ACE Archive Handling Buffer Overflow"

Previous message: Cooper, Russ: "Administrivia: Zotob/PnP Exploit Survey"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

32919 - Computer Associates Message Queuing (CAM/CAFT) multiple vulnerabilities
... vulnerability issues in the CA Message Queuing ... Attackers can potentially exploit a CAM TCP port vulnerability ... Unicenter Performance Management for OpenVMS r2.4 SP3 ...
(Bugtraq)
[Full-disclosure] 32919 - Computer Associates Message Queuing (CAM/CAFT) multiple vulnerabilities
... vulnerability issues in the CA Message Queuing ... Attackers can potentially exploit a CAM TCP port vulnerability ... Unicenter Performance Management for OpenVMS r2.4 SP3 ...
(Full-Disclosure)
SecurityFocus Microsoft Newsletter #355
... MICROSOFT VULNERABILITY SUMMARY ... EDraw Office Viewer Component ActiveX Control Arbitrary File Overwrite Vulnerability ... EFS Software Easy Chat Server Authentication Request Handling Remote Denial Of Service Vulnerability ... Successfully exploiting these issues allows attackers with local, interactive access to affected computers to gain SYSTEM-level privileges. ...
(Focus-Microsoft)
SecurityFocus Microsoft Newsletter #291
... MICROSOFT VULNERABILITY SUMMARY ... Caucho Resin Viewfile Information Disclosure Vulnerability ... Raydium Multiple Remote Buffer Overflow and Denial Of Service Vulnerabilities ... Attackers exploiting latent vulnerabilities in services running with these low-privilege accounts may take advantage of this weakness to gain elevated privileges. ...
(Focus-Microsoft)
[NT] Vulnerability in Message Queuing Allows Code Execution (MS07-065)
... Vulnerability in Message Queuing Allows Code Execution ... This important security update resolves a privately reported vulnerability ... privilege in implementations on Microsoft Windows 2000 Professional and ...
(Securiteam)