CVE-2008-2541 Multiple stack-based buffer overflows in the HTTP Gateway Service (icihttp.exe) in CA eTrust Secure Content Manager 8.0 allow remote attackers to execute arbitrary code or cause a denial of service vi...
HighCVSS 10.0
EPSS 10.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple stack-based buffer overflows in the HTTP Gateway Service (icihttp.exe) in CA eTrust Secure Content Manager 8.0 allow remote attackers to execute arbitrary code or cause a denial of service via long FTP responses, related to (1) the file month field in a LIST command; (2) the PASV command; and (3) directories, files, and links in a LIST command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ca etrust secure content manager | = 8.0 | No fix listed |
References
- dvlabs.tippingpoint.com
- 30518 third-party-advisory vendor-advisory
- www.ca.com
- 20080604 ZDI-08-036: CA ETrust Secure Content Manager Gateway FTP LIST Stack Overflow mailing-list
- 20080604 ZDI-08-035: CA ETrust Secure Content Manager Gateway FTP PASV Stack Overflow Vulnerability mailing-list
- 20080604 TPTI-08-05: CA ETrust Secure Content Manager Gateway FTP LIST Stack Overflow Vulnerability mailing-list
- 20080604 CA Secure Content Manager HTTP Gateway Service FTP Request Vulnerabilities mailing-list
- 29528 vdb-entry
- 1020167 vdb-entry
- ADV-2008-1741 vdb-entry vendor-advisory
- www.zerodayinitiative.com
- www.zerodayinitiative.com
- ca-etrust-scm-ftp-bo(42821) vdb-entry
- support.ca.com patch