CA20110223-01 Security Notice for CA Host-Based Intrusion Prevention System - CA Technologies
{{search ? 'Close':'Search'}}

CA20110223-01: Security Notice for CA Host-Based Intrusion Prevention System

Issued: February 23, 2011
Last Updated: February 24, 2011

CA Technologies support is alerting customers to a security risk associated with CA Host-Based Intrusion Prevention System (HIPS). A vulnerability exists that can allow a remote attacker to execute arbitrary code. CA Technologies has issued patches to address the vulnerability.

The vulnerability, CVE-2011-1036, is due to insecure method implementation in the XMLSecDB ActiveX control that is utilized in CA HIPS components and products. A remote attacker can potentially execute arbitrary code if he can trick a user into visiting a malicious web page or opening a malicious file.

Risk Rating

Medium

Platform

Windows

Affected Products

CA Host-Based Intrusion Prevention System (HIPS) r8.1
CA Internet Security Suite (ISS) 2010
CA Internet Security Suite (ISS) 2011

How to determine if the installation is affected

HIPS Management Server is vulnerable if the version number is less than 8.1.0.88.

HIPS client sources are vulnerable if the build number is less than 1.6.450.

CA Internet Security Suite (ISS) 2010 is vulnerable if the ISS product version is equal to or less than 6.0.0.285 and the HIPS version is equal to or less than 1.6.384.

CA Internet Security Suite (ISS) 2011 is vulnerable if the ISS product version is equal to or less than 7.0.0.115 and the HIPS version is equal to or less than 1.6.418.

Older versions of HIPS and ISS, that are no longer supported, may also be vulnerable.

Solution

CA has issued the following patches to address the vulnerability.

CA Host-Based Intrusion Prevention System (HIPS) r8.1:
RO26950

Apply RO26950 and set the DWORD "ProtectParser" under
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesUmxCfg to "1". You do not need to restart the client.

CA Internet Security Suite (ISS) 2010:
Fix information will be published soon.

CA Internet Security Suite (ISS) 2011:
Fix information will be published soon.

References

CVE-2011-1036 - CA HIPS XMLSecDB ActiveX control insecure methods

Acknowledgement

Andrea Micalizzi aka rgod, via TippingPoint ZDI

Change History

Version 1.0: Initial Release
Version 1.5: Added ISS 2011 to list of affected products. Added instructions for determining if ISS is affected.

If additional information is required, please contact CA Technologies Support at https://support.ca.com.

If you discover a vulnerability in a CA Technologies product, please report your findings to the CA Technologies Product Vulnerability Response Team.

Chat with CA

Just give us some brief information and we'll connect you to the right CA Expert.

Our hours of availability are 8AM - 5PM CST.

All Fields Required

connecting

We're matching your request.

Unfortunately, we can't connect you to an agent. If you are not automatically redirected please click here.

  • {{message.agentProfile.name}} will be helping you today.

    View Profile


  • Transfered to {{message.agentProfile.name}}

    {{message.agentProfile.name}} joined the conversation

    {{message.agentProfile.name}} left the conversation

  • Your chat with {{$storage.chatSession.messages[$index - 1].agentProfile.name}} has ended.
    Thank you for your interest in CA.


    How Did We Do?
    Let us know how we did so that we can maintain a quality experience.

    Take Our Survey >

    Rate Your Chat Experience.

    {{chat.statusMsg}}

agent is typing