Issued: February 23, 2011
Last Updated: February 24, 2011

CA Technologies support is alerting customers to a security risk associated with CA Host-Based Intrusion Prevention System (HIPS). A vulnerability exists that can allow a remote attacker to execute arbitrary code. CA Technologies has issued patches to address the vulnerability.

The vulnerability, CVE-2011-1036, is due to insecure method implementation in the XMLSecDB ActiveX control that is utilized in CA HIPS components and products. A remote attacker can potentially execute arbitrary code if he can trick a user into visiting a malicious web page or opening a malicious file.

Risk Rating

Medium

Platform

Windows

Affected Products

CA Host-Based Intrusion Prevention System (HIPS) r8.1
CA Internet Security Suite (ISS) 2010
CA Internet Security Suite (ISS) 2011

How to determine if the installation is affected

HIPS Management Server is vulnerable if the version number is less than 8.1.0.88.

HIPS client sources are vulnerable if the build number is less than 1.6.450.

CA Internet Security Suite (ISS) 2010 is vulnerable if the ISS product version is equal to or less than 6.0.0.285 and the HIPS version is equal to or less than 1.6.384.

CA Internet Security Suite (ISS) 2011 is vulnerable if the ISS product version is equal to or less than 7.0.0.115 and the HIPS version is equal to or less than 1.6.418.

Older versions of HIPS and ISS, that are no longer supported, may also be vulnerable.

Solution

CA has issued the following patches to address the vulnerability.

CA Host-Based Intrusion Prevention System (HIPS) r8.1:
RO26950

Apply RO26950 and set the DWORD "ProtectParser" under
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesUmxCfg to "1". You do not need to restart the client.

CA Internet Security Suite (ISS) 2010:
Fix information will be published soon.

CA Internet Security Suite (ISS) 2011:
Fix information will be published soon.

References

CVE-2011-1036 - CA HIPS XMLSecDB ActiveX control insecure methods

Acknowledgement

Andrea Micalizzi aka rgod, via TippingPoint ZDI

Change History

Version 1.0: Initial Release
Version 1.5: Added ISS 2011 to list of affected products. Added instructions for determining if ISS is affected.

If additional information is required, please contact CA Technologies Support at https://support.ca.com.

If you discover a vulnerability in a CA Technologies product, please report your findings to the CA Technologies Product Vulnerability Response Team.