PT-2008-3968 · Ca · Ca Internet Security Suite

Nine:Situations:Group · Published 2008-06-02 · Updated 2018-10-11 · CVE-2008-2511

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CA Internet Security Suite 2008

Description A directory traversal issue exists in the UmxEventCli.CachedAuditDataList.1 ActiveX control, allowing remote attackers to create and overwrite arbitrary files by using a .. (dot dot) in the argument to the SaveToFile method. This can potentially be leveraged for code execution by writing to a Startup folder.

Recommendations For CA Internet Security Suite 2008, consider disabling the SaveToFile method in the UmxEventCli.CachedAuditDataList.1 ActiveX control as a temporary workaround to minimize the risk of exploitation. Restrict access to sensitive folders, such as Startup folders, to prevent potential code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-2511

Affected Products

Ca Internet Security Suite

References · 8

• 🔥 https://exploit-db.com/exploits/5682 · Exploit
• 🔥 http://retrogod.altervista.org/9sg_CA_poc.html · Exploit
• http://secunia.com/advisories/30420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2511 · Security Note
• http://vupen.com/english/advisories/2008/1696/references · Note
• http://securityfocus.com/archive/1/492679/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42712 · Note
• http://securitytracker.com/id?1020129 · Note