Computer Security
[EN] securityvulns.ru no-pyccku


CA Internet Security / CA Host-Based Intrusion Prevention System code execution
updated since 24.02.2011
Published:28.02.2011
Source:
SecurityVulns ID:11457
Type:client
Threat Level:
6/10
Description:SetXml and Save methods of HIPSEngine component allows to save file to any location.
CVE:CVE-2011-1036 (The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine component in the Management Server before 8.1.0.88, and the client before 1.6.450, in CA Host-Based Intrusion Prevention System (HIPS) 8.1, as used in CA Internet Security Suite (ISS) 2010, allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via vectors involving the SetXml and Save methods.)
Original documentdocumentCA, CA20110223-01: Security Notice for CA Host-Based Intrusion Prevention System (28.02.2011)
 documentZDI, ZDI-11-093: CA Internet Security Suite HIPS XML Security Database Parser Class Remote Code Execution Vulnerability (24.02.2011)

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod