SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Security)  >   eTrust Antivirus Vendors:   CA
CA Anti-Virus Arclib Bug Lets Remote Users Bypass Malware Detection
SecurityTracker Alert ID:  1021639
SecurityTracker URL:  http://securitytracker.com/id/1021639
CVE Reference:   CVE-2009-0042   (Links to External Site)
Date:  Jan 28 2009
Impact:   Modification of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2007 (v8), 2008
Description:   A vulnerability was reported in CA Anti-Virus. A remote user can bypass anti-virus detection.

A remote user can create a specially crafted archive containing malicious software that will not be detected by the anti-virus engine.

The system will detect the malicious software when the archive is extracted.

The following product versions are also affected:

CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1, r8, r8.1
CA Anti-Virus Gateway (formerly eTrust Antivirus Gateway) 7.1
eTrust EZ Antivirus r7, r6.1
CA Internet Security Suite 2007 (v3), 2008
CA Internet Security Suite Plus 2008
CA Threat Manager for the Enterprise (formerly eTrust Integrated Threat Management) r8, 8.1
CA Protection Suites r2, r3, r3.1
CA Secure Content Manager (formerly eTrust Secure Content Manager) 8.0, 8.1
CA Anti-Spyware for the Enterprise (Formerly eTrust PestPatrol) r8, 8.1
CA Anti-Spyware 2007, 2008
CA Network and Systems Management (NSM) (formerly Unicenter Network and Systems Management) r3.0, r3.1, r11, r11.1
CA ARCserve Backup r11.1, r11.5, r12 on Windows
CA ARCserve Backup r11.1, r11.5 Linux
CA ARCserve client agent for Windows
CA eTrust Intrusion Detection 2.0 SP1, 3.0, 3.0 SP1, 4.0
CA Common Services (CCS) r11, r11.1
CA Anti-Virus SDK (formerly eTrust Anti-Virus SDK)

Thierry Zoller and Sergio Alvarez of n.runs AG reported this vulnerability.

Impact:   A remote user can evade anti-virus detection.
Solution:   The vendor has issued a fix (arclib version 7.3.0.15, released in September 2008).

The vendor's advisory is available at:

https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197601

Vendor URL:  support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197601 (Links to External Site)
Cause:   Input validation error
Underlying OS:   Linux (Any), UNIX (OS X), UNIX (Solaris - SunOS), Windows (Any)

Message History:   None.


 Source Message Contents

Date:  Tue, 27 Jan 2009 10:07:01 -0500
Subject:  CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Title: CA20090126-01: CA Anti-Virus Engine Detection Evasion 
Multiple Vulnerabilities


CA Advisory Reference: CA20090126-01


CA Advisory Date: 2009-01-26


Reported By:
Thierry Zoller and Sergio Alvarez of n.runs AG


Impact: A remote attacker can evade detection.


Summary: The CA Anti-Virus engine contains multiple 
vulnerabilities that can allow a remote attacker to evade 
detection by the Anti-Virus engine by creating a malformed archive 
file in one of several common file archive formats. CA has 
released a new Anti-Virus engine to address the vulnerabilities. 
The vulnerabilities, CVE-2009-0042, are due to improper handling 
of malformed archive files by the Anti-Virus engine. A remote 
attacker can create a malformed archive file that potentially 
contains malware and evade anti-virus detection.

Note: After files have been extracted from an archive, the desktop 
Anti-Virus engine is able to scan all files for malware. 
Consequently, detection evasion can be a concern for gateway 
anti-virus software if archives are not scanned, but the risk is 
effectively mitigated by the desktop anti-virus engine.


Mitigating Factors: See note above.


Severity: CA has given these vulnerabilities a Low risk rating.


Affected Products:
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1, 
   r8, r8.1
CA Anti-Virus 2007 (v8), 2008
eTrust EZ Antivirus r7, r6.1
CA Internet Security Suite 2007 (v3), 2008
CA Internet Security Suite Plus 2008
CA Threat Manager for the Enterprise (formerly eTrust Integrated 
   Threat Management) r8, 8.1
CA Anti-Virus Gateway (formerly eTrust Antivirus Gateway) 7.1
CA Protection Suites r2, r3, r3.1
CA Secure Content Manager (formerly eTrust Secure Content 
   Manager) 8.0, 8.1
CA Anti-Spyware for the Enterprise (Formerly eTrust 
   PestPatrol) r8, 8.1
CA Anti-Spyware 2007, 2008
CA Network and Systems Management (NSM) (formerly Unicenter 
   Network and Systems Management) r3.0, r3.1, r11, r11.1
CA ARCserve Backup r11.1, r11.5, r12 on Windows
CA ARCserve Backup r11.1, r11.5 Linux
CA ARCserve client agent for Windows
CA eTrust Intrusion Detection 2.0 SP1, 3.0, 3.0 SP1, 4.0
CA Common Services (CCS) r11, r11.1
CA Anti-Virus SDK (formerly eTrust Anti-Virus SDK)


Non-Affected Products:
CA Anti-Virus engine with arclib version 7.3.0.15 installed


Affected Platforms:
Windows
UNIX
Linux
Solaris
Mac OS X
NetWare


Status and Recommendation:
CA released arclib 7.3.0.15 in September 2008.  If your product is 
configured for automatic updates, you should already be protected, 
and you need to take no action.  If your product is not configured 
for automatic updates, then you simply need to run the update 
utility included with your product.


How to determine if you are affected:

For products on Windows:

1. Using Windows Explorer, locate the file "arclib.dll". By 
   default, the file is located in the 
   "C:\Program Files\CA\SharedComponents\ScanEngine" directory (*).
2. Right click on the file and select Properties.
3. Select the Version tab.
4. If the file version is earlier than indicated below, the 
   installation is vulnerable.

File Name    File Version
arclib.dll   7.3.0.15

*For eTrust Intrusion Detection 2.0 the file is located in 
"Program Files\eTrust\Intrusion Detection\Common", and for eTrust 
Intrusion Detection 3.0 and 3.0 sp1, the file is located in 
"Program Files\CA\Intrusion Detection\Common".

For CA Anti-Virus r8.1 on non-Windows platforms:

Use the compver utility provided on the CD to determine the 
version of Arclib. If the version is less than 7.3.0.15, the 
installation is vulnerable. 

Example compver utility output:
     ------------------------------------------------
     COMPONENT NAME                           VERSION
     ------------------------------------------------
     eTrust Antivirus Arclib Archive Library  7.3.0.15
     ... (followed by other components)

For reference, the following are file names for arclib on 
non-Windows operating systems:

Operating System    File name
Solaris             libarclib.so
Linux               libarclib.so
Mac OS X            arclib.bundle


Workaround: 
Do not open email attachments or download files from untrusted 
sources.


References (URLs may wrap):
CA Support:
http://support.ca.com/
CA20090126-01: Security Notice for CA Anti-Virus Engine
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1976
01
Solution Document Reference APARs:
n/a
CA Security Response Blog posting:
CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple 
Vulnerabilities
community.ca.com/blogs/casecurityresponseblog/archive/2009/01/26.aspx
Reported By: 
Thierry Zoller and Sergio Alvarez of n.runs AG
http://www.nruns.com/
http://secdev.zoller.lu
CVE References:
CVE-2009-0042 - Anti-Virus detection evasion
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0042
OSVDB References: Pending
http://osvdb.org/


Changelog for this advisory:
v1.0 - Initial Release


Customers who require additional information should contact CA
Technical Support at http://support.ca.com.

For technical questions or comments related to this advisory, 
please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your 
findings to the CA Product Vulnerability Response Team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1777
82


Regards,
Ken Williams, Director ; 0xE2941985
CA Product Vulnerability Response Team


CA, 1 CA Plaza, Islandia, NY 11749
	
Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2009 CA. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.9.1 (Build 287)
Charset: utf-8

wj8DBQFJfyMKeSWR3+KUGYURAkyRAJ94Db9OT0mSDBo8UiSAK7AWWt5XSgCfc89J
SlKLxRwfw06DmTk2tmlcrJI=
=Kjse
-----END PGP SIGNATURE-----


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC