CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2010-5156
https://notcve.org/view.php?id=CVE-2010-5156
Race condition in CA Internet Security Suite Plus 2010 6.0.0.272 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute ** EN DISPUTA ** Condición de Carrera en CA Internet Security Suite Plus 2010 v6.0.0.272 para Windows XP permite a usuarios locales eludir los manejadores de hooks a nivel de kernel, y ejecutar código peligroso que de otra manera sería bloqueada por el manejador y no por una detección basada en firma de malware. Esto se consigue a través de ciertos cambios en la memoria de espacio de usuario durante la ejecución del manejador de hooks. Se trata de un problema también conocido como un ataque argument-switch o un ataque KHOBE. NOTA: este problema es discutido por algunos, ya que es un defecto en un mecanismo de protección para situaciones en las que un programa hecho a mano ya ha comenzado a ejecutarse. • http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php http://www.f-secure.com/weblog/archives/00001949.html http://www.osvdb.org/67660 http://www.securit • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 9.3EPSS: 90%CPEs: 3EXPL: 0CVE-2011-1036 – CA Internet Security Suite HIPS XML Security Database Parser Class Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-1036
The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine component in the Management Server before 8.1.0.88, and the client before 1.6.450, in CA Host-Based Intrusion Prevention System (HIPS) 8.1, as used in CA Internet Security Suite (ISS) 2010, allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via vectors involving the SetXml and Save methods. La clase XML Security Database Parser en el control XMLSecDB ActiveX en el componente HIPSEngine en el Management Server anterior a v8.1.0.88, y el cliente anterior a v1.6.450, en CA Host-Based Intrusion Prevention System (HIPS) v8.1, que se utiliza en CA Internet Security Suite (ISS) de 2010, permite a atacantes remotos descargar un programa arbitrario en un equipo cliente, y ejecutar el mismo a través de vectores que comprenden los métodos SetXml y Save. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Internet Security Suite 2010. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the XMLSecDB ActiveX control which is installed with HIPSEngine component. SetXml and Save methods are implemented insecurely and can allow creation of an arbitrary file on the victim's system. • http://secunia.com/advisories/43377 http://secunia.com/advisories/43490 http://securityreason.com/securityalert/8106 http://www.securityfocus.com/archive/1/516649/100/0/threaded http://www.securityfocus.com/archive/1/516687/100/0/threaded http://www.securityfocus.com/bid/46539 http://www.securitytracker.com/id?1025120 http://www.vupen.com/english/advisories/2011/0496 http://www.zerodayinitiative.com/advisories/ZDI-11-093 https://exchange.xforce.ibmcloud.com/vulnerabilities/65632 https&# •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2010-4502 – CA Internet Security Suite 2010 - 'KmxSbx.sys' Kernel Pool Overflow
https://notcve.org/view.php?id=CVE-2010-4502
Integer overflow in KmxSbx.sys 6.2.0.22 in CA Internet Security Suite Plus 2010 allows local users to cause a denial of service (pool corruption) and execute arbitrary code via crafted arguments to the 0x88000080 IOCTL, which triggers a buffer overflow. Desbordamienteo de entero en KmxSbx.sys v6.2.0.22 de CA Internet Security Suite Plus 2010 permite a los usuarios locales causar una denegación de servicio (corrupción del pool) y ejecutar código a su elección a través de argumentos manipulados a el 0x88000080 IOCTL, lo cual genera un desbordamiento de búfer. • https://www.exploit-db.com/exploits/15624 http://secunia.com/advisories/42267 http://www.exploit-db.com/exploits/15624 http://www.securitytracker.com/id?1024808 http://www.vupen.com/english/advisories/2010/3070 • CWE-189: Numeric Errors •