CA20090126-01: Security Notice for CA Anti-Virus Engine - CA Technologies
{{search ? 'Close':'Search'}}

CA20090126-01: Security Notice for CA Anti-Virus Engine

Issued: January 26, 2009
Last Updated: May 12, 2009

CA's support is alerting customers to multiple security risks associated with the CA Anti-Virus engine. Multiple vulnerabilities exist that can allow a remote attacker to evade detection by the Anti-Virus engine by creating a malformed archive file in one of several common file archive formats. CA has released a new Anti-Virus engine to address the vulnerabilities.

The vulnerabilities, CVE-2009-0042, are due to improper handling of malformed archive files by the Anti-Virus engine. A remote attacker can create a malformed archive file that potentially contains malware and evade anti-virus detection.

Note: After files have been extracted from an archive, the desktop Anti-Virus engine is able to scan all files for malware. Consequently, detection evasion can be a concern for gateway anti-virus software if archives are not scanned, but the risk is effectively mitigated by the desktop anti-virus engine.

Risk Rating

Low

Platforms

Windows
UNIX
Linux
Solaris
Mac OS X
NetWare

Affected Products

CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1, r8, r8.1
CA Anti-Virus 2007 (v8), 2008
eTrust EZ Antivirus r6.1, r7, r7.1
CA Internet Security Suite 2007 (v3), 2008
CA Internet Security Suite Plus 2008
CA Threat Manager for the Enterprise (formerly eTrust Integrated Threat Management) r8, 8.1
CA Anti-Virus Gateway (formerly eTrust Antivirus Gateway) 7.1
CA Gateway Security r8.1
CA Protection Suites r2, r3, r3.1
CA Secure Content Manager (formerly eTrust Secure Content Manager) 1.1, 8.0, 8.1
CA Anti-Spyware for the Enterprise (Formerly eTrust PestPatrol) r8, 8.1
CA Anti-Spyware 2007, 2008
CA Network and Systems Management (NSM) (formerly Unicenter Network and Systems Management) r3.0, r3.1, r11, r11.1
CA ARCserve Backup r11.1, r11.5, r12 on Windows
CA ARCserve Backup r11.1, r11.5 Linux
CA ARCserve for Windows Client Agent
CA ARCserve for Windows Server component
CA eTrust Intrusion Detection 2.0 SP1, 3.0, 3.0 SP1
CA Common Services (CCS) r3.1, r11, r11.1
CA Anti-Virus SDK (formerly eTrust Anti-Virus SDK)

Non-Affected Products

CA Anti-Virus engine with arclib version 7.3.0.15 installed

How to determine if the installation is affected

For products on Windows:

  1. Using Windows Explorer, locate the file "arclib.dll". By default, the file is located in the "C:Program FilesCASharedComponentsScanEngine" directory (*).

  2. Right click on the file and select Properties.

  3. Select the Version tab.

  4. If the file version is earlier than indicated below, the installation is vulnerable.
File Name File Version
arclib.dll 7.3.0.15


*For eTrust Intrusion Detection 2.0 the file is located in "Program FileseTrustIntrusion DetectionCommon", and for eTrust Intrusion Detection 3.0 and 3.0 sp1, the file is located in "Program FilesCAIntrusion DetectionCommon".

For CA Anti-Virus r8.1 on non-Windows platforms:

Use the compver utility provided on the CD to determine the version of Arclib. If the version is less than 7.3.0.15, the installation is vulnerable.

Example compver utility output:

                                       ------------------------------------------------                                        COMPONENT NAME VERSION                                        ------------------------------------------------                                        eTrust Antivirus Arclib Archive Library 7.3.0.15                                        ... (followed by other components)                                                                                                                                                              

For reference, the following are file names for arclib on non-Windows operating systems:

Operating System File name
Solaris libarclib.so
Linux libarclib.so
Mac OS X arclib.bundle


Solution

CA released arclib 7.3.0.15 in September 2008. If your product is configured for automatic updates, you should already be protected, and you need to take no action. If your product is not configured for automatic updates, then you simply need to run the update utility included with your product.

CA Network and Systems Management (NSM) r11.1 SP1, and CA Common Services (CCS) r11.1 SP1: apply fix # RO05417.

CA Common Services (CCS) r3.1: apply fix # RO05418.

CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1: apply fix # RO01955.

CA Secure Content Manager (formerly eTrust Secure Content Manager) r1.1: apply fix # RO05629.

CA Secure Content Manager (formerly eTrust Secure Content Manager) r8.0: apply fix # RO05309.

CA Secure Content Manager (formerly eTrust Secure Content Manager) r8.1: apply fix # RO05868.

CA Anti-Virus Gateway (formerly eTrust Antivirus Gateway) 7.1: apply fix # RO05631.

CA Gateway Security r8.1: apply Cumulative Fix 1.

CA ARCserve for Windows Server component installed on a 64 bit machine: apply fixes # RO01955 and RO01956.

CA ARCserve for Windows Server component installed on a 32 bit machine: apply fix # RO01955.

CA ARCserve for Windows Client Agent installed on a 64 bit machine: apply fix # RO01956.

CA ARCserve for Windows Client Agent installed on a 32 bit machine: apply fix # RO01955.

CA ARCserve for Linux Server r11.5: apply fix # RO01959.

CA ARCserve for Linux:

  1. Download RO01959.tar.Z from RO01959 into a temporary location /tmp/RO01959

  2. Uncompress and untar RO01959.tar.Z as follows:
    uncompress RO01959.tar.Z
    tar -xvf RO01959.tar
    The new "libarclib.so" will be extracted to /tmp/RO01959

  3. Change the directory to $CAIGLBL0000/ino/config as follows:
    cd $CAIGLBL0000/ino/config

  4. Rename "libarclib.so" to "libarclib.so.RO01959" as follows:
    mv libarclib.so libarclib.so.RO01959

  5. Copy the new libarclib.so as follows:
    cp /tmp/RO01959/libarclib.so $CAIGLBL0000/ino/config/.

  6. chmod +x $CAIGLBL0000/ino/config/libarclib.so

  7. Stop the common agent (caagent stop)

  8. Change the directory to ARCserve common agent directory (typically /opt/CA/BABcmagt)
    cd /opt/CA/BABcmagt
    Note: To find out the agent home directory run the following command:
    dirname 'ls -l /usr/bin/caagent |cut -f2 -d">"'

  9. Save a copy of libarclib.so
    cp -p libarclib.so libarclib.so.RO01959

  10. Copy over the new libarclib.so as follows:
    cp $/tmp/RO01959/libarclib.so.

  11. Start the common agent (caagent start)

  12. Repeat steps (7-11) on all remote Linux client agents' installations.

  13. rm -rf /tmp/RO01959

Workaround

Do not open email attachments or download files from untrusted sources.

References

CVE-2009-0042 - Anti-Virus detection evasion

Acknowledgement

CVE-2009-0042 - Thierry Zoller and Sergio Alvarez of n.runs AG

Change History

Version 1.0: Initial Release
Version 1.1: Updated list of affected products, and added solutions.
Version 1.2: Added CA ARCserve patch solution.
Version 1.3: Updated CA ARCserve patch solution.

If additional information is required, please contact CA Support at https://support.ca.com.

If you discover a vulnerability in CA products, please report your findings to the CA Product Vulnerability Response Team.

Chat with CA

Just give us some brief information and we'll connect you to the right CA Expert.

Our hours of availability are 8AM - 5PM CST.

All Fields Required

connecting

We're matching your request.

Unfortunately, we can't connect you to an agent. If you are not automatically redirected please click here.

  • {{message.agentProfile.name}} will be helping you today.

    View Profile


  • Transfered to {{message.agentProfile.name}}

    {{message.agentProfile.name}} joined the conversation

    {{message.agentProfile.name}} left the conversation

  • Your chat with {{$storage.chatSession.messages[$index - 1].agentProfile.name}} has ended.
    Thank you for your interest in CA.


    How Did We Do?
    Let us know how we did so that we can maintain a quality experience.

    Take Our Survey >

    Rate Your Chat Experience.

    {{chat.statusMsg}}

agent is typing