CA20141001-01: Security Notice for Bash Shellshock Vulnerability

2014-10-07 Thread Williams, James K
CA20141001-01: Security Notice for Bash Shellshock Vulnerability Issued: October 01, 2014 Updated: October 03, 2014 CA Technologies is investigating multiple GNU Bash vulnerabilities, referred to as the Shellshock vulnerabilities, which were publicly disclosed on September 24-27, 2014. CVE

CA20140413-01: Security Notice for OpenSSL Heartbleed Vulnerability

2014-05-16 Thread Williams, James K
CA20140413-01: Security Notice for OpenSSL Heartbleed Vulnerability Issued: April 13, 2014 Updated: May 12, 2014 CA Technologies is investigating an OpenSSL vulnerability, referred to as the Heartbleed bug that was publicly disclosed on April 7, 2014. CVE identifier CVE-2014-0160 has been

CA20140218-01: Security Notice for CA 2E Web Option

2014-02-19 Thread Williams, James K
CA20140218-01: Security Notice for CA 2E Web Option Issued: February 18, 2014 CA Technologies Support is alerting customers to a potential risk in CA 2E Web Option (C2WEB). A vulnerability exists that can allow an attacker to exploit an authentication weakness and execute a session

RE: CVE-2014-1219 - Unauthenticated Privilege Escalation in CA 2E Web Option

2014-02-14 Thread Williams, James K
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Date: Wed, 12 Feb 2014 15:59:34 - From: Portcullis Advisories advisor...@portcullis-security.com [snip] Vulnerability title: Unauthenticated Privilege Escalation in CA 2E Web Option CVE: CVE-2014-1219 Vendor: CA Product: 2E Web Option

CA20121220-01: Security Notice for CA IdentityMinder [updated]

2013-01-21 Thread Williams, James K
CA20121220-01: Security Notice for CA IdentityMinder Issued: December 20, 2012 Updated: January 18, 2013 CA Technologies Support is alerting customers to two potential risks in CA IdentityMinder (formerly known as CA Identity Manager). Two vulnerabilities exist that can allow a remote

CA20121220-01: Security Notice for CA IdentityMinder

2012-12-24 Thread Williams, James K
CA20121220-01: Security Notice for CA IdentityMinder Issued: December 20, 2012 CA Technologies Support is alerting customers to two potential risks in CA IdentityMinder (formerly known as CA Identity Manager). Two vulnerabilities exist that can allow a remote attacker to execute arbitrary

CA20121001-01: Security Notice for CA License

2012-10-02 Thread Williams, James K
CA20121001-01: Security Notice for CA License Issued: October 01, 2012 CA Technologies Support is alerting customers to two potential risks in CA License (also known as CA Licensing). Vulnerabilities exist that can allow a local attacker to execute arbitrary commands or gain elevated

CA20111208-01: Security Notice for CA SiteMinder [updated]

2012-08-28 Thread Williams, James K
CA20111208-01: Security Notice for CA SiteMinder Issued: December 08, 2011 Updated: August 22, 2012 CA Technologies Support is alerting customers to a potential risk in CA SiteMinder, CA Federation Manager, CA SOA Security Manager, CA SiteMinder Secure Proxy Server, and CA SiteMinder

CA20111208-01: Security Notice for CA SiteMinder

2011-12-09 Thread Williams, James K
CA20111208-01: Security Notice for CA SiteMinder Issued: December 08, 2011 CA Technologies Support is alerting customers to a potential risk in CA SiteMinder. A vulnerability exists that can allow a malicious user to execute a reflected cross site scripting (XSS) attack. CA Technologies has

Re: CA ARCserve D2D r15 GWT RPC Request Auth Bypass / Credentials

2011-08-09 Thread Williams, James K
Technologies Business Unit Operations wilj...@ca.com -Original Message- From: Williams, James K Sent: Tuesday, July 26, 2011 1:12 PM To: bugtraq@securityfocus.com Subject: Re: CA ARCserve D2D r15 GWT RPC Request Auth Bypass / Credentials Re: CA ARCserve D2D r15 GWT RPC Request Auth Bypass

Re: CA ARCserve D2D r15 GWT RPC Request Auth Bypass / Credentials

2011-07-26 Thread Williams, James K
Re: CA ARCserve D2D r15 GWT RPC Request Auth Bypass / Credentials CA Technologies is aware of ARCserve D2D vulnerability and exploit details that were posted to BugTraq on 2011-07-26. We're currently reviewing the information and will post an update after we have completed our initial

RE: CA20110420-02: Security Notice for CA Output Management Web Viewer

2011-05-19 Thread Williams, James K
CA20110420-01: Security Notice for CA SiteMinder Issued: April 20, 2011 Updated: May 19, 2011 CA Technologies support is alerting customers to a security risk associated with CA SiteMinder. A vulnerability exists that can allow a malicious user to impersonate another user. CA

CA20110420-02: Security Notice for CA Output Management Web Viewer

2011-04-21 Thread Williams, James K
CA20110420-02: Security Notice for CA Output Management Web Viewer Issued: April 20, 2011 CA Technologies support is alerting customers to security risks associated with CA Output Management Web Viewer. Two vulnerabilities exist that can allow a remote attacker to execute arbitrary code.

CA20110420-01: Security Notice for CA SiteMinder

2011-04-21 Thread Williams, James K
CA20110420-01: Security Notice for CA SiteMinder Issued: April 20, 2011 CA Technologies support is alerting customers to a security risk associated with CA SiteMinder. A vulnerability exists that can allow a malicious user to impersonate another user. CA Technologies has issued patches

CA20110223-01: Security Notice for CA Host-Based Intrusion Prevention System

2011-02-25 Thread Williams, James K
CA20110223-01: Security Notice for CA Host-Based Intrusion Prevention System Issued: February 23, 2011 Updated: February 24, 2011 CA Technologies support is alerting customers to a security risk associated with CA Host-Based Intrusion Prevention System (HIPS). A vulnerability exists that can

CA20101231-01: Security Notice for CA ARCserve D2D (updated)

2011-01-28 Thread Williams, James K
CA20101231-01: Security Notice for CA ARCserve D2D Issued: December 31, 2010 Last Updated: January 26, 2011 CA Technologies support is alerting customers to a security risk with CA ARCserve D2D. A vulnerability exists that can allow a remote attacker to execute arbitrary code. CA has issued

CA20101231-01: Security Notice for CA ARCserve D2D

2010-12-31 Thread Williams, James K
CA20101231-01: Security Notice for CA ARCserve D2D Issued: December 31, 2010 CA Technologies support is alerting customers to a security risk with CA ARCserve D2D. A vulnerability exists that can allow a remote attacker to execute arbitrary code. CA has issued an Information Solution to

CA20100304-01: Security Notice for CA SiteMinder

2010-03-04 Thread Williams, James K
CA20100304-01: Security Notice for CA SiteMinder Issued: March 04, 2010 CA's support is alerting customers to a security risk with CA SiteMinder. Multiple cross site scripting (XSS) vulnerabilities exist that can allow a remote attacker to potentially gain sensitive information. CA has

CA20091008-01: Security Notice for CA Anti-Virus Engine

2009-10-09 Thread Williams, James K
CA20091008-01: Security Notice for CA Anti-Virus Engine Issued: October 8, 2009 CA's support is alerting customers to multiple security risks associated with CA Anti-Virus Engine. Vulnerabilities exist in the arclib component that can allow a remote attacker to cause a denial of service,

CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities

2009-06-16 Thread Williams, James K
Title: CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities CA Advisory Reference: CA20090615-01 CA Advisory Date: 2009-06-15 Reported By: iViZ Security Research Team Impact: A remote attacker can cause a denial of service. Summary: CA ARCserve Backup

CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities (Updated)

2009-06-16 Thread Williams, James K
Title: CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities CA Advisory Reference: CA20090615-01 CA Advisory Date: 2009-06-15 Reported By: iViZ Security Research Team Impact: A remote attacker can cause a denial of service. Summary: CA ARCserve Backup

CA20090615-02: CA Service Desk Tomcat Cross Site Scripting Vulnerability

2009-06-16 Thread Williams, James K
Title: CA20090615-02: CA Service Desk Tomcat Cross Site Scripting Vulnerability CA Advisory Reference: CA20090615-02 CA Advisory Date: 2009-06-15 Impact: A remote attacker can inject arbitrary web script or HTML. Summary: The release of Tomcat as included with CA Service Desk r11.2 is

CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities [Updated]

2009-05-12 Thread Williams, James K
Title: CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities CA Advisory Reference: CA20090126-01 CA Advisory Date: 2009-01-26 CA Advisory Updated: May 12, 2009 Reported By: Thierry Zoller and Sergio Alvarez of n.runs AG Impact: A remote attacker can evade

CA20090429-01: CA ARCserve Backup Apache HTTP Server Multiple Vulnerabilities

2009-05-01 Thread Williams, James K
Title: CA20090429-01: CA ARCserve Backup Apache HTTP Server Multiple Vulnerabilities CA Advisory Reference: CA20090429-01 CA Advisory Date: 2009-04-29 Reported By: Apache Software Foundation David Endler of iDefense Ulf Harnhammar for SITIC, Swedish IT Incident Centre Impact: A remote

CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)

2009-01-27 Thread Williams, James K
Title: CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities CA Advisory Reference: CA20090123-01 CA Advisory Date: 2009-01-23 Reported By: n/a Impact: Refer to the CVE identifiers for details. Summary: Multiple security risks exist in Apache Tomcat as included with CA Cohesion

CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities

2009-01-27 Thread Williams, James K
Title: CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities CA Advisory Reference: CA20090126-01 CA Advisory Date: 2009-01-26 Reported By: Thierry Zoller and Sergio Alvarez of n.runs AG Impact: A remote attacker can evade detection. Summary: The CA Anti-Virus

CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities

2009-01-26 Thread Williams, James K
Title: CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities CA Advisory Reference: CA20090123-01 CA Advisory Date: 2009-01-23 Reported By: n/a Impact: A remote attacker can execute arbitrary commands. Summary: Multiple security risks exist in Apache Tomcat as included with CA

CA20090107-01: CA Service Metric Analysis and CA Service Level Management smmsnmpd Arbitrary Command Execution Vulnerability

2009-01-07 Thread Williams, James K
Title: CA20090107-01: CA Service Metric Analysis and CA Service Level Management smmsnmpd Arbitrary Command Execution Vulnerability CA Advisory Reference: CA20090107-01 CA Advisory Date: 2009-01-07 Reported By: Michel Arboi of Tenable Network Security Impact: A remote attacker can

CA ARCserve Backup LDBserver Vulnerability

2008-12-10 Thread Williams, James K
Title: CA ARCserve Backup LDBserver Vulnerability CA Advisory Date: 2008-12-10 Reported By: Dyon Balding of Secunia Research Impact: A remote attacker can cause a denial of service or execute arbitrary code. Summary: CA ARCserve Backup contains a vulnerability that can allow a remote

CA ARCserve Backup Multiple Vulnerabilities

2008-10-10 Thread Williams, James K
Title: CA ARCserve Backup Multiple Vulnerabilities CA Advisory Date: 2008-10-09 Reported By: Haifei Li of Fortinet's FortiGuard Global Security Research Team Vulnerability Research Team of Assurent Secure Technologies, a TELUS Company Greg Linares of eEye Digital Security Impact: A

CA Service Desk Multiple Cross-Site Scripting Vulnerabilities

2008-09-26 Thread Williams, James K
Title: CA Service Desk Multiple Cross-Site Scripting Vulnerabilities CA Advisory Date: 2008-09-24 Reported By: Open Security Foundation Impact: A remote attacker can conduct cross-site scripting attacks. Summary: CA Service Desk contains multiple vulnerabilities that can allow a remote

CA Products That Embed Ingres Multiple Vulnerabilities

2008-08-06 Thread Williams, James K
Title: CA Products That Embed Ingres Multiple Vulnerabilities CA Advisory Date: 2008-08-01 Reported By: iDefense Labs Impact: A remote attacker can execute arbitrary code, gain privileges, or cause a denial of service condition. Summary: CA products that embed Ingres contain multiple

CA ARCserve Backup Discovery Service Denial of Service Vulnerability

2008-06-18 Thread Williams, James K
Title: CA ARCserve Backup Discovery Service Denial of Service Vulnerability CA Advisory Date: 2008-06-17 Reported By: Luigi Auriemma Impact: A remote attacker can cause a denial of service. Summary: CA ARCserve Backup contains a vulnerability in the Discovery service (casdscsvc) that

CA Secure Content Manager HTTP Gateway Service FTP Request Vulnerabilities

2008-06-05 Thread Williams, James K
Title: CA Secure Content Manager HTTP Gateway Service FTP Request Vulnerabilities CA Advisory Date: 2008-06-03 Reported By: Sebastian Apelt working with ZDI/TippingPoint Cody Pierce, TippingPoint DVLabs Impact: A remote attacker can cause a denial of service or execute

CA DSM gui_cm_ctrls ActiveX Control Vulnerability

2008-04-16 Thread Williams, James K
Title: CA DSM gui_cm_ctrls ActiveX Control Vulnerability CA Advisory Date: 2008-04-15 Reported By: Greg Linares of eEye Digital Security Impact: A remote attacker can execute arbitrary code or cause a denial of service condition. Summary: CA products that implement the DSM gui_cm_ctrls

CA ARCserve Backup for Laptops and Desktops Server and CA Desktop Management Suite Multiple Vulnerabilities

2008-04-04 Thread Williams, James K
Title: CA ARCserve Backup for Laptops and Desktops Server and CA Desktop Management Suite Multiple Vulnerabilities CA Advisory Date: 2008-04-03 Reported By: Dyon Balding of Secunia Research Impact: A remote attacker can execute arbitrary code or cause a denial of service condition. Summary:

CA Alert Notification Server Multiple Vulnerabilities

2008-04-04 Thread Williams, James K
Title: CA Alert Notification Server Multiple Vulnerabilities CA Advisory Date: 2008-04-03 Reported By: An anonymous researcher working with the iDefense VCP Impact: A remote authenticated attacker can execute arbitrary code or cause a denial of service condition. Summary: CA Alert

CA Multiple Products DSM ListCtrl ActiveX Control Buffer Overflow Vulnerability

2008-03-28 Thread Williams, James K
Title: CA Multiple Products DSM ListCtrl ActiveX Control Buffer Overflow Vulnerability CVE: CVE-2008-1472 CA Advisory Date: 2008-03-28 Reported By: Exploit code posted at milw0rm.com Impact: A remote attacker can cause a denial of service or execute arbitrary code. Summary: CA products

Note about recently publicized CA BrightStor ActiveX exploit code

2008-03-20 Thread Williams, James K
CA is reviewing exploit code that was posted on 2008-03-16 to the Milw0rm exploit archive web site. This exploit code is potentially associated with vulnerabilities that may exist in CA BrightStor ARCserve Backup for Laptops and Desktops and/or related products. CA will issue an advisory

[CAID 35724, 35725, 35726]: CA BrightStor ARCserve Backup Multiple Vulnerabilities

2007-12-07 Thread Williams, James K
Title: [CAID 35724, 35725, 35726]: CA BrightStor ARCserve Backup Multiple Vulnerabilities CA Vuln ID (CAID): 35724, 35725, 35726 CA Advisory Date: 2007-10-10 CA Advisory Updated: 2007-12-05 Reported By: Anonymous researcher working with the iDefense VCP (CVE-2007-5325) Dyon Balding of

Re: SiteMinder Agent: Cross Site Scripting

2007-11-09 Thread Williams, James K
Subject: SiteMinder Agent: Cross Site Scripting From: Giuseppe Gottardi overet () securitydate ! it Date: 2007-11-07 3:10:00 Security Advisory for CA Products utilizing CA SiteMinder Web Agent Last Updated: November 8, 2007 CA is aware of a report describing a cross-site scripting

[CAID 35754]: CA Host-Based Intrusion Prevention System (CA HIPS) Server Vulnerability

2007-10-19 Thread Williams, James K
Title: [CAID 35754]: CA Host-Based Intrusion Prevention System (CA HIPS) Server Vulnerability CA Vuln ID (CAID): 35754 CA Advisory Date: 2007-10-18 Reported By: David Maciejak Impact: A remote attacker can take unauthorized administrative action. Summary: CA Host-Based Intrusion Prevention

[CAID 35724, 35725, 35726]: CA BrightStor ARCserve Backup Multiple Vulnerabilities

2007-10-11 Thread Williams, James K
Title: [CAID 35724, 35725, 35726]: CA BrightStor ARCserve Backup Multiple Vulnerabilities CA Vuln ID (CAID): 35724, 35725, 35726 CA Advisory Date: 2007-10-10 Reported By: Anonymous researcher working with the iDefense VCP (CVE-2007-5325) Dyon Balding of Secunia Research (CVE-2007-5326)

[CAID 35690, 35691, 35692]: CA BrightStor Hierarchical Storage Manager CsAgent Multiple Vulnerabilities

2007-09-27 Thread Williams, James K
Title: [CAID 35690, 35691, 35692]: CA BrightStor Hierarchical Storage Manager CsAgent Multiple Vulnerabilities CA Vuln ID (CAID): 35690, 35691, 35692 CA Advisory Date: 2007-09-26 Reported By: Sean Larsson, iDefense Labs anonymous researcher working with the iDefense VCP

[CAID 35673, 35674, 35675, 35676, 35677]: CA ARCserve Backup for Laptops and Desktops Multiple Server Vulnerabilities

2007-09-21 Thread Williams, James K
Title: [CAID 35673, 35674, 35675, 35676, 35677]: CA ARCserve Backup for Laptops and Desktops Multiple Server Vulnerabilities CA Vuln ID (CAID): 35673, 35674, 35675, 35676, 35677 CA Advisory Date: 2007-09-20 Reported By: Sean Larsson (VeriSign iDefense Labs) anonymous researcher

RE: [CAID 35525, 35526]: CA Products Arclib Library Denial of Service Vulnerabilities

2007-07-26 Thread Williams, James K
-Original Message- From: Williams, James K Sent: Tuesday, July 24, 2007 7:56 PM To: 'bugtraq@securityfocus.com' Subject: [CAID 35525, 35526]: CA Products Arclib Library Denial of Service Vulnerabilities Title: [CAID 35525, 35526]: CA Products Arclib Library Denial

[CAID 35527]: CA Message Queuing (CAM / CAFT) Buffer Overflow Vulnerability

2007-07-25 Thread Williams, James K
Title: [CAID 35527]: CA Message Queuing (CAM / CAFT) Buffer Overflow Vulnerability CA Vuln ID (CAID): 35527 CA Advisory Date: 2007-07-24 Reported By: Paul Mehta of ISS X-Force Impact: A remote attacker can execute arbitrary code. Summary: Multiple CA products that utilize CA Message Queuing

[CAID 35524]: CA eTrust Intrusion Detection caller.dll Vulnerability

2007-07-25 Thread Williams, James K
Title: [CAID 35524]: eTrust Intrusion Detection caller.dll Vulnerability CA Vuln ID (CAID): 35524 CA Advisory Date: 2007-07-24 Reported By: Sebastian Apelt working with the iDefense VCP Impact: A remote attacker can execute arbitrary code. Summary: CA eTrust Intrusion Detection contains a

[CAID 35525, 35526]: CA Products Arclib Library Denial of Service Vulnerabilities

2007-07-25 Thread Williams, James K
Title: [CAID 35525, 35526]: CA Products Arclib Library Denial of Service Vulnerabilities CA Vuln ID (CAID): 35525, 35526 CA Advisory Date: 2007-07-24 Reported By: CVE-2006-5645 - Titon of BastardLabs and Damian Put pucik at overflow dot pl working with the iDefense VCP. CVE-2007-3875 - An

[CAID 35515]: CA Products Alert Service RPC Procedure Buffer Overflow Vulnerabilities

2007-07-19 Thread Williams, James K
Title: [CAID 35515]: CA Products Alert Service RPC Procedure Buffer Overflow Vulnerabilities CA Vuln ID (CAID): 35515 CA Advisory Date: 2007-07-17 Reported By: Anonymous researcher working with the iDefense VCP Impact: Remote attacker can cause a denial of service or execute arbitrary code.

[CAID 35450, 35451, 35452, 35453]: CA Products That Embed Ingres Multiple Vulnerabilities

2007-06-22 Thread Williams, James K
Title: [CAID 35450, 35451, 35452, 35453]: CA Products That Embed Ingres Multiple Vulnerabilities CA Vuln ID (CAID): 35450, 35451, 35452, 35453 CA Advisory Date: 2007-06-21 Reported By: NGSSoftware, and iDefense Impact: Attackers can potentially execute arbitrary code, or overwrite files.

[CAID 35395, 35396]: CA Anti-Virus Engine CAB File Buffer Overflow Vulnerabilities

2007-06-07 Thread Williams, James K
Title: [CAID 35395, 35396]: CA Anti-Virus Engine CAB File Buffer Overflow Vulnerabilities CA Vuln ID (CAID): 35395, 35396 CA Advisory Date: 2007-06-05 Reported By: ZDI Impact: Remote attackers can cause a denial of service or potentially execute arbitrary code. Summary: CA Anti-Virus

[CAID 35330, 35331]: CA Anti-Virus, CA Threat Manager, and CA Anti-Spyware Console Login and File Mapping Vulnerabilities

2007-05-12 Thread Williams, James K
Title: [CAID 35330, 35331]: CA Anti-Virus, CA Threat Manager, and CA Anti-Spyware Console Login and File Mapping Vulnerabilities CA Vuln ID (CAID): 35330, 35331 CA Advisory Date: 2007-05-09 Reported By: ZDI, iDefense Impact: Attackers can cause a denial of service or potentially execute

[CAID 35198, 35276]: CA BrightStor ARCserve Backup Media Server Vulnerabilities

2007-04-26 Thread Williams, James K
Title: [CAID 35198, 35276]: CA BrightStor ARCserve Backup Media Server Vulnerabilities CA Vuln ID (CAID): 35198, 35276 CA Advisory Date: 2007-04-24 Reported By: ZDI Impact: Remote attackers can cause a denial of service or potentially execute arbitrary code. Summary: CA BrightStor ARCserve

CA BrightStor ARCserve Backup Mediasvr.exe vulnerability

2007-03-31 Thread Williams, James K
CA is aware that functional exploit code was publicized on March 30, 2007 for a CA BrightStor ARCserve Backup Mediasvr.exe vulnerability. We have verified that a high risk vulnerability does exist and we are now working on a patch to address the issue. CA recommends that BrightStor

[CAID 34817, 35058, 35158, 35159]: CA BrightStor ARCserve Backup Tape Engine and Portmapper Vulnerabilities

2007-03-16 Thread Williams, James K
Title: [CAID 34817, 35058, 35158, 35159]: CA BrightStor ARCserve Backup Tape Engine and Portmapper Vulnerabilities CA Vuln ID (CAID): 34817, 35058, 35158, 35159 CA Advisory Date: 2007-03-15 Reported By: McAfee Impact: Remote attackers can cause a denial of service or potentially execute

[CAID 35145]: CA eTrust Admin Privilege Escalation Vulnerability

2007-03-09 Thread Williams, James K
Title: [CAID 35145]: CA eTrust Admin Privilege Escalation Vulnerability CA Vuln ID (CAID): 35145 CA Advisory Date: 2007-03-08 Impact: Attackers can gain escalated privileges. Summary: The CA eTrust Admin GINA component contains a privilege escalation vulnerability within the reset password

[CAID 35112]: CA eTrust Intrusion Detection Denial of Service Vulnerability

2007-02-28 Thread Williams, James K
Title: [CAID 35112]: CA eTrust Intrusion Detection Denial of Service Vulnerability CA Vuln ID (CAID): 35112 CA Advisory Date: 2007-02-27 Reported By: iDefense Impact: Remote attackers can cause a denial of service condition. Summary: CA eTrust Intrusion Detection contains a vulnerability

[CAID 34818]: CA Personal Firewall Multiple Privilege Escalation Vulnerabilities

2007-01-25 Thread Williams, James K
Title: [CAID 34818]: CA Personal Firewall Multiple Privilege Escalation Vulnerabilities CA Vuln ID (CAID): 34818 CA Advisory Date: 2007-01-22 Discovered By: Reverse Mode Impact: Local attacker can gain escalated privileges. Summary: Multiple vulnerabilities have been discovered in CA

[CAID 34993]: CA BrightStor ARCserve Backup for Laptops and Desktops Multiple Overflow Vulnerabilities

2007-01-24 Thread Williams, James K
Title: [CAID 34993]: CA BrightStor ARCserve Backup for Laptops and Desktops Multiple Overflow Vulnerabilities CA Vuln ID (CAID): 34993 CA Advisory Date: 2007-01-23 Discovered By: Next Generation Security Software Impact: Remote attacker can cause a denial of service or execute arbitrary

[CAID 34955, 34956, 34957, 34958, 34959, 34817]: CA BrightStor ARCserve Backup Multiple Overflow Vulnerabilities

2007-01-12 Thread Williams, James K
Title: [CAID 34955, 34956, 34957, 34958, 34959, 34817]: BrightStor ARCserve Backup Multiple Overflow Vulnerabilities CA Vuln ID (CAID): 34955, 34956, 34957, 34958, 34959, 34817 CA Advisory Date: 2007-01-11 Discovered By: TippingPoint, IBM ISS, iDefense Labs Impact: Remote attacker can

CA BrightStor ARCserve Backup Tape Engine Exploit Security Notice

2007-01-09 Thread Williams, James K
CA BrightStor ARCserve Backup Tape Engine Exploit Security Notice CA is aware that exploit code for a vulnerability in the Tape Engine component of CA BrightStor ARCserve Backup was posted on several security web sites and mailing lists on January 5, 2007. This vulnerability is fixed in

[CAID 34876]: CA CleverPath Portal Session Inheritance Vulnerability

2006-12-21 Thread Williams, James K
Title: CAID 34876: CA CleverPath Portal Session Inheritance Vulnerability CA Vulnerability ID (CAID): 34876 CA Advisory Date: 2006-12-19 Discovered By: CA customer and CA Technical Support Impact: Remote attackers can potentially gain access to a user's Portal session. Summary: CA

[CAID 34870]: CA Anti-Virus vetfddnt.sys, vetmonnt.sys Local Denial of Service Vulnerabilities

2006-12-14 Thread Williams, James K
Title: CAID 34870: CA Anti-Virus vetfddnt.sys, vetmonnt.sys Local Denial of Service Vulnerabilities CA Vulnerability ID (CAID): 34870 CA Advisory Date: 2006-12-13 Discovered By: Rubén Santamarta (reversemode.com) Impact: Local unprivileged attacker can cause a denial of service. Summary:

Re: LS-20061001 - Computer Associates BrightStor ARCserve Backup

2006-12-11 Thread Williams, James K
List: bugtraq Subject:LS-20061001 - Computer Associates BrightStor ARCserve Backup From: advisories () lssec ! com Date: 2006-12-08 21:28:39 LS-20061001 [...] Technical details: http://www.lssec.com/advisories.html LSsecurity - LSsec.com CA is

Re: LS-20060908 - Computer Associates BrightStor ARCserve Backup

2006-12-11 Thread Williams, James K
List: bugtraq Subject:LS-20060908 - Computer Associates BrightStor ARCserve Backup From: advisories () lssec ! com Date: 2006-12-08 21:26:30 LS-20060908 [...] Technical details: http://www.lssec.com/advisories.html LSsecurity - LSsec.com CA

[CAID 34846]: CA BrightStor ARCserve Backup Discovery Service Buffer Overflow Vulnerability

2006-12-08 Thread Williams, James K
Title: CAID 34846: CA BrightStor ARCserve Backup Discovery Service Buffer Overflow Vulnerability CA Vulnerability ID (CAID): 34846 CA Advisory Date: 2006-12-07 Discovered By: Assurent Secure Technologies (assurent.com) Impact: Remote attacker can execute arbitrary code. Summary: CA

RE: LS-20061113 - CA BrightStor ARCserve Backup Remote Buffer Overflow Vulnerability

2006-11-22 Thread Williams, James K
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Tuesday, November 21, 2006 5:07 AM To: bugtraq@securityfocus.com Subject: LS-20061113 - CA BrightStor ARCserve Backup Remote Buffer Overflow Vulnerability LS-20061113 LSsec has discovered a

RE: [Reversemode advisory] Computer Associates HIPS Drivers - multiple local privilege escalation vulnerabilities.

2006-11-21 Thread Williams, James K
-Original Message- From: Reversemode [mailto:[EMAIL PROTECTED] Sent: Thursday, November 16, 2006 11:15 AM To: Securityfocus Subject: [Reversemode advisory] Computer Associates HIPS Drivers - multiple local privilege escalation vulnerabilities. Computer Associates Host

[CAID 34693, 34694]: CA BrightStor ARCserve Backup Multiple Buffer Overflow Vulnerabilities (UPDATED)

2006-10-20 Thread Williams, James K
Our original fixes for the BrightStor ARCserve Backup vulnerabilities that we publicly disclosed on 2006-10-05 (http://www3.ca.com/securityadvisor/blogs/posting.aspx?id=90744pid=93775date=2006/10) did not completely resolve one of the vulnerabilities. Consequently, we have released new fixes

[CAID 34693, 34694]: CA BrightStor ARCserve Backup Multiple Buffer Overflow Vulnerabilities

2006-10-06 Thread Williams, James K
Title: CAID 34693, 34694: CA BrightStor ARCserve Backup Multiple Buffer Overflow Vulnerabilities CA Vulnerability ID (CAID): 34693, 34694 CA Advisory Date: 2006-10-05 Discovered By: TippingPoint, www.zerodayinitiative.com Impact: Remote attacker can execute arbitrary code. Summary: CA

[CAID 34661]: CA Unicenter WSDM File System Read Access Vulnerability

2006-10-04 Thread Williams, James K
Title: CAID 34661: CA Unicenter WSDM File System Read Access Vulnerability CA Vulnerability ID (CAID): 34661 CA Advisory Date: 2006-10-03 Discovered By: Oliver Karow, Symantec Security Consultant oliver_karow at symantec dot com Richard Sammet, Symantec Security Consultant richard_sammet at

[CAID 34616, 34617, 34618]: CA eSCC and eTrust Audit vulnerabilities

2006-09-21 Thread Williams, James K
Title: CAID 34616, 34617, 34618: CA eTrust Security Command Center and eTrust Audit vulnerabilities CA Vulnerability ID (CAID): 34616, 34617, 34618 CA Advisory Date: 2006-09-20 Discovered By: Patrick Webster of aushack.com Impact: Remote attacker can read/delete files, or potentially

CAID 34509 - CA eTrust Antivirus WebScan vulnerabilities

2006-08-04 Thread Williams, James K
Title: CA eTrust Antivirus WebScan vulnerabilities CA Vulnerability ID (CAID): 34509 CA Advisory Date: 2006-08-03 Discovered By: Matt Murphy of the TippingPoint Security Research Team Impact: Remote attacker can execute arbitrary code. Summary: Ca eTrust Antivirus WebScan is a free,

CAID 34013 - CA Common Services CAIRIM on z/OS LMP SVC vulnerability

2006-05-08 Thread Williams, James K
Title: CAID 34013 - CA Common Services CAIRIM on z/OS LMP SVC vulnerability CA Vulnerability ID: 34013 CA Advisory Date: 2006-05-02 Discovered By: IBM Global Services Impact: Local attacker can gain escalated privileges. Summary: A potential vulnerability issue exists in our CAIRIM LMP

CAID 33581 - CA Message Queuing Denial of Service Vulnerabilities

2006-02-02 Thread Williams, James K
Title: CAID 33581 - CA Message Queuing Denial of Service Vulnerabilities CA Vulnerability ID: 33581 CA Advisory Date: 2006-02-02 Discovered By: Nicolas Pouvesle of Tenable Network Security Impact: Remote attacker can cause a denial of service condition. Summary: The following two security

CAID 33778 - CA iGateway Content-Length Buffer Overflow Vulnerability [v1.1]

2006-01-27 Thread Williams, James K
Please see below for important changes to CAID 33778. Changelog is near end of advisory. Regards, Ken Williams Title: CAID 33778 - CA iGateway Content-Length Buffer Overflow Vulnerability [v1.1] CA Vulnerability ID: 33778 CA Advisory Date: 2006-01-23 Updated Advisory [v1.1]: 2006-01-26

CAID 33756 - DM Deployment Common Component Vulnerabilities

2006-01-19 Thread Williams, James K
Title: CAID 33756 - DM Deployment Common Component Vulnerabilities CA Vulnerability ID: 33756 Discovery Date: 2005-12-20 CA Advisory Date: 2006-01-17 Discovered By: Cengiz Aykanat (CA internal audit), and Karma[at]DesignFolks[dot]com[dot]au. Impact: Remote attacker can cause a denial of

Re: Hidden accounts on sony vaio laptops

2005-11-08 Thread Williams, James K
Not a Sony issue. This setup has been documented by MS since the release of Windows XP in 2001. Q: How can I add an Administrator password to make my computer more secure? A: Another way to make your computer more secure is to assign a password to the Administrator account, which is blank

Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through forged magic byte

2005-10-29 Thread Williams, James K
Subject: Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through forged magic byte From: Andrey Bayora andrey () securityelf ! org Date: 2005-10-25 3:07:51 [...] VULNERABLE vendors and software (tested): [...] 3. eTrust CA (ver 7.0.1.4, engine 11.9.1, vir