PT-2007-2434 · Ca · Etrust Intrusion Detection

Published 2007-03-02 · Updated 2021-04-09 · CVE-2007-1005

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: CA eTrust Intrusion Detection versions 3.0.5.57 and earlier

Description: The issue is related to a heap-based buffer overflow in the eID Engine service, specifically in the SW3eng.exe component. This can be triggered by remote attackers sending a long key length value to the remote administration port (9191/tcp), resulting in a denial of service (application crash).

Recommendations: For versions 3.0.5.57 and earlier, consider restricting access to the remote administration port (9191/tcp) to minimize the risk of exploitation. As a temporary workaround, limit the key length value accepted by the eID Engine service to prevent the buffer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-1005

Affected Products

Etrust Intrusion Detection

References · 9

• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=484 · Vendor Advisory
• http://secunia.com/advisories/24309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1005 · Security Note
• http://securityfocus.com/bid/22743 · Patch
• http://supportconnectw.ca.com/public/ca_common_docs/eid_secnotice.asp · Vendor Advisory
• http://securitytracker.com/id?1017706 · Note
• http://vupen.com/english/advisories/2007/0776 · Note
• http://osvdb.org/32290 · Note
• http://securityfocus.com/archive/1/461567/100/100/threaded · Note