Multiply Vulnerabilities With Computer Associates

[Mobo]

The Computer Associates License Client/Server applications provide a method for CA products to register their licenses on the network.

The CA Licence client/server contains multiply vulnerabilities.


Vulnerable Systems:
* CA License software v1.53 through v1.61.8.

The vulnerability specifically exists because of insufficient bounds checking on user-supplied values in requests with an invalid format.
When a packet containing an overly long string which is not a valid command is received, the server uses that string to generate a log message without checking if the buffer that the message is being stored in is large enough. By sending a string over 2100 bytes long, it is
possible to overwrite the saved instruction pointer, allowing execution of arbitrary code.

Patches are available from CA to meet this vulnerability at the link below:
http://supportconnectw.ca.com/public/ca_co...rity_notice.asp