CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities

On January 26th, 2009, CA published a security notice to address multiple vulnerabilities in the CA Anti-Virus engine.

 

On January 26th, 2009, CA published a security notice to address multiple vulnerabilities in the CA Anti-Virus engine.

 

Title: CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities

CA Advisory Reference: CA20090126-01

CA Advisory Date: 2009-01-26

Reported By: Thierry Zoller and Sergio Alvarez of n.runs AG

Impact: A remote attacker can evade detection.

Summary: The CA Anti-Virus engine contains multiple vulnerabilities that can allow a remote attacker to evade detection by the Anti-Virus engine by creating a malformed archive file in one of several common file archive formats. CA has released a new Anti-Virus engine to address the vulnerabilities. The vulnerabilities, CVE-2009-0042, are due to improper handling of malformed archive files by the Anti-Virus engine. A remote attacker can create a malformed archive file that potentially contains malware and evade anti-virus detection.

Note: After files have been extracted from an archive, the desktop Anti-Virus engine is able to scan all files for malware. Consequently, detection evasion can be a concern for gateway anti-virus software if archives are not scanned, but the risk is effectively mitigated by the desktop anti-virus engine.

Mitigating Factors: See note above.

Severity: CA has given these vulnerabilities a Low risk rating.

Affected Products:
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1, r8, r8.1
CA Anti-Virus 2007 (v8), 2008
eTrust EZ Antivirus r7, r6.1
CA Internet Security Suite 2007 (v3), 2008
CA Internet Security Suite Plus 2008
CA Threat Manager for the Enterprise (formerly eTrust Integrated Threat Management) r8, 8.1
CA Anti-Virus Gateway (formerly eTrust Antivirus Gateway) 7.1
CA Protection Suites r2, r3, r3.1
CA Secure Content Manager (formerly eTrust Secure Content Manager) 8.0, 8.1
CA Anti-Spyware for the Enterprise (Formerly eTrust PestPatrol) r8, 8.1
CA Anti-Spyware 2007, 2008
CA Network and Systems Management (NSM) (formerly Unicenter Network and Systems Management) r3.0, r3.1, r11, r11.1
CA ARCserve Backup r11.1, r11.5, r12 on Windows
CA ARCserve Backup r11.1, r11.5 Linux
CA ARCserve client agent for Windows
CA eTrust Intrusion Detection 2.0 SP1, 3.0, 3.0 SP1, 4.0
CA Common Services (CCS) r11, r11.1
CA Anti-Virus SDK (formerly eTrust Anti-Virus SDK)

Non-Affected Products:
CA Anti-Virus engine with arclib version 7.3.0.15 installed

Affected Platforms:
Windows
UNIX
Linux
Solaris
Mac OS X
NetWare

Status and Recommendation:
CA released arclib 7.3.0.15 in September 2008.  If your product is configured for automatic updates, you should already be protected, and you need to take no action.  If your product is not configured for automatic updates, then you simply need to run the update utility included with your product.

How to determine if you are affected:

For products on Windows:

1. Using Windows Explorer, locate the file “arclib.dll”. By default, the file is located in the “C:Program FilesCASharedComponentsScanEngine” directory (*).
2. Right click on the file and select Properties.
3. Select the Version tab.
4. If the file version is earlier than indicated below, the installation is vulnerable.

File Name File Version
arclib.dll 7.3.0.15

*For eTrust Intrusion Detection 2.0 the file is located in “Program FileseTrustIntrusion DetectionCommon”, and for eTrust Intrusion Detection 3.0 and 3.0 sp1, the file is located in “Program FilesCAIntrusion DetectionCommon”.

For CA Anti-Virus r8.1 on non-Windows platforms:

Use the compver utility provided on the CD to determine the version of Arclib. If the version is less than 7.3.0.15, the installation is vulnerable.

Example compver utility output:

   ------------------------------------------------
COMPONENT NAME VERSION
------------------------------------------------
eTrust Antivirus Arclib Archive Library 7.3.0.15
... (followed by other components)

For reference, the following are file names for arclib on non-Windows operating systems:

Operating System File name
Solaris libarclib.so
Linux libarclib.so
Mac OS X arclib.bundle

Workaround:
Do not open email attachments or download files from untrusted sources.

References (URLs may wrap):
CA Support:
http://support.ca.com/
CA20090126-01: Security Notice for CA Anti-Virus Engine
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197601
Solution Document Reference APARs:
n/a
CA Security Response Blog posting:
CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/26.aspx
Reported By:
Thierry Zoller and Sergio Alvarez of n.runs AG
http://www.nruns.com/
http://secdev.zoller.lu
CVE References:
CVE-2009-0042 – Anti-Virus detection evasion
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0042
OSVDB References: Pending
http://osvdb.org/

Changelog for this advisory:
v1.0 – Initial Release

Customers who require additional information should contact CATechnical Support at http://support.ca.com.

For technical questions or comments related to this advisory, please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your findings to the CA Product Vulnerability Response Team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782

Written by

Ken Williams

Ken Williams is a Director with the CA Vulnerability Research Team. As a veteran vulnerability…

Published in

View this topic
  • James Holland

    This is great. Hooray for Disney’s imagineers!

  • http://www.sheistocktips.com/ SHRISTOCKTIPS

    SHRISTOCKTIPS has
    become a new brand in the share market research with its accurate research. Proven
    itself always right whether market is bull or bear. Last week all paid clients
    booked handsome profit in NIFTY, BANKINIFTY & STOCKS. Now for the coming
    week we expect more correction can come in NIFTY as the IRAQ issue is getting
    more tense, If it happens more then you will see a sharp fall in all world marketNSE BSE, STOCK TIPSbecause as we know all world run on
    crude & most of the crude comes from IRAQ. So be ready for a sharp fall so
    sell will be the best strategy for next week also. Traders can make a sell
    position in NIFTY around 7600-7650 with stoploss 7750 for the target of
    7300-7200.One can also make a sell call NIFTY 50 stocks as per NIFTY levels. You
    can also take our two days free trial to check our accuracy. For further updates
    you can visit our website. http://goo.gl/sMgZ7n

    Regards

    SHRISTOCKTIPS TEAM

  • king lear

    testing comment functionality, please do not publish this

  • http://www.rachelmacik.com Rachel Macik

    Love the personal pic :)

    • CAHighlight

      Thank you!

  • Plutora Inc

    This is a good case study. 2.3 sec’s off a login transaction is big.

  • http://www.linkedin.com/in/michelehudnall Michele Hudnall

    While the analysts were hyping DevOps, I posted the oversight of not including security as part of that discussion as you are highlighting here. Instead of just talking DevOps, it should be DOS (what’s old is new again :-) – DevOpsSec. As a previous AppDev person, it’s the app, who’s using it, why and where rather than the device and having the service available.

    As you rightly point, out Security should be baked into the solution.
    https://www.netiq.com/communities/data-center-solutions/accelerating_business_overhauling_service_management/

    Nice Post and Timely!

    @HudnallsHuddle

    • CAHighlight

      Thank you for your feedback Michele. Agreed – security cannot be overlooked. Appreciate your input!

  • Mitesh

    I would love a printed copy

  • Lars Johansson

    I love the idea of BYOID! This makes me choose if I am almost anonymous (with my Hotmail Nicname) or official with identity from an official organisation. My Identity Provider will attach identity with right level of LoA according to the need of the Service provider.

    • CAHighlight

      Thank you for your comment. BYOID has tangible benefits for end users and relying parties but it also has to be weighed in the balance with potential risks and liability concerns. It will be interesting to see how BYOID plays out in the enterprise.