PT-2006-4118 · Ca · Etrust Antivirus+2

Publicado 2006-06-27 · Atualizado 2021-04-09 · CVE-2006-3223

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CA Integrated Threat Management (ITM) version r8 eTrust Antivirus (eAV) version r8 eTrust PestPatrol (ePP) version r8

Description The issue allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a scan job with format strings in the description field. This can be achieved by including format strings in the description field of a scan job.

Recommendations For CA Integrated Threat Management (ITM) version r8, consider restricting the use of format strings in the description field of scan jobs until a fix is available. For eTrust Antivirus (eAV) version r8, avoid using format strings in the description field of scan jobs to minimize the risk of exploitation. For eTrust PestPatrol (ePP) version r8, temporarily disable the ability to include format strings in scan job descriptions as a mitigation measure.

Correção

Identificadores relacionados

CVE-2006-3223

Produtos afetados

Ca Integrated Threat Management

Etrust Antivirus

Etrust Pestpatrol

Referências · 12

• http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047423.html · Nota
• http://securityfocus.com/archive/1/438582/100/0/threaded · Nota
• http://vupen.com/english/advisories/2006/2565 · Nota
• http://securityfocus.com/archive/1/438503/100/0/threaded · Nota
• http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34325 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-3223 · Nota de Segurança
• http://osvdb.org/26654 · Nota
• https://t.me/cvenotify/12994 · Publicação no Telegram
• http://secunia.com/advisories/20856 · Nota
• http://securitytracker.com/id?1016391 · Nota
• http://securityfocus.com/bid/18689 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27374 · Nota