CVE-2011-2667 Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitra...
HighCVSS 10.0
EPSS 16.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and daemon crash) via a malformed request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| broadcom total defense | = r12 | No fix listed |
| ca gateway security | = 8.1 | No fix listed |
References
- 45332 third-party-advisory vendor-advisory
- 8316 third-party-advisory
- 1025812 vdb-entry
- 1025813 vdb-entry
- 20110720 ZDI-11-237: CA Total Defense Suite Gateway Security Malformed HTTP Packet Remote Code Execution Vulnerability mailing-list
- 20110720 CA20110720-01: Security Notice for CA Gateway Security and Total Defense mailing-list
- 48813 vdb-entry
- www.zerodayinitiative.com
- totaldefense-gateway-url-code-execution(68736) vdb-entry
- support.ca.com