CVE-2007-2523

CA (Multiple Products) - Console Server / 'InoCore.dll' Remote Code Execution

Severity Score

7.2

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

CA Anti-Virus for the Enterprise r8 and Threat Manager r8 before 20070510 use weak permissions (NULL security descriptor) for the Task Service shared file mapping, which allows local users to modify this mapping and gain privileges by triggering a stack-based buffer overflow in InoCore.dll before 8.0.448.0.

El Anti-Virus CA para la Enterprise r8 y el Threat Manager r8 antes del 20070510 usa permisos débiles (seguridad de descriptor NULL) para el fichero de mapeo compartido del Task Service, lo cual permite a usuarios locales modificar este mapeo y obtener privilegios mediante el disparo de un desbordamiento de búfer basado en pila en el InoCore.dll en versiones anteriores a 8.0.448.0.

*Credits: N/A

CVSS Scores

NISTv2 7.2

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-05-08 CVE Reserved
2007-05-09 First Exploit
2007-05-11 CVE Published
2023-03-08 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (12)

URL	Tag	Source
http://blog.48bits.com/?p=103	X_refsource_misc
http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063275.html	Mailing List
http://secunia.com/advisories/25202	Third Party Advisory
http://www.kb.cert.org/vuls/id/788416	Third Party Advisory
http://www.osvdb.org/34586	Vdb Entry
http://www.securityfocus.com/archive/1/468306/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/23906	Vdb Entry
http://www.securitytracker.com/id?1018043	Vdb Entry
http://www.vupen.com/english/advisories/2007/1750	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/30019	2007-05-09

URL	Date	SRC
http://supportconnectw.ca.com/public/antivirus/infodocs/caav-secnotice050807.asp	2021-04-09

URL	Date	SRC
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=530	2021-04-09

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Broadcom Search vendor "Broadcom"		Integrated Threat Management Search vendor "Broadcom" for product "Integrated Threat Management"				8.0 Search vendor "Broadcom" for product "Integrated Threat Management" and version "8.0"		-		Affected
Ca Search vendor "Ca"		Anti-virus For The Enterprise Search vendor "Ca" for product "Anti-virus For The Enterprise"				8 Search vendor "Ca" for product "Anti-virus For The Enterprise" and version "8"		enterprise		Affected