Ca Multiple Products Buffer Overflow

[Mobo]

a vulnerability in various Computer Associates products, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an integer overflow in the Vet Antivirus Engine (VetE.dll) when analysing OLE streams. This can be exploited to cause a heap-based buffer overflow via e.g. a specially crafted Microsoft Office document.

Successful exploitation allows execution of arbitrary code.

The vulnerability affects the following products:
* CA InoculateIT 6.0 (all platforms, including Notes/Exchange)
* eTrust Antivirus r6.0 (all platforms, including Notes/Exchange)
* eTrust Antivirus r7.0 (all platforms, including Notes/Exchange)
* eTrust Antivirus r7.1 (all platforms, including Notes/Exchange)
* eTrust Antivirus for the Gateway r7.0 (all modules and platforms)
* eTrust Antivirus for the Gateway r7.1 (all modules and platforms)
* eTrust Secure Content Manager (all releases)
* eTrust Intrusion Detection (all releases)
* BrightStor ARCserve Backup (BAB) r11.1 Windows
* eTrust EZ Antivirus r6.2 - r7.0.5
* eTrust EZ Armor r1.0 - r2.4.4
* eTrust EZ Armor LE r2.0 - r3.0.0.14
* Vet Antivirus r10.66 and below

Solution:
Update to Vet engine 11.9.1 or later.

Provided and/or discovered by:
Alex Wheeler

Original Advisory:
Alex Wheeler:
http://www.rem0te.com/public/images/vet.pdf