CVE-2005-3653
Heap-based buffer overflow in the iGateway service for various Computer Associates (CA) iTechnology products, in iTechnology iGateway before 4.0.051230, allows remote attackers to execute arbitrary code via an HTTP request with a negative Content-Length…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 18.6%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Heap-based buffer overflow in the iGateway service for various Computer Associates (CA) iTechnology products, in iTechnology iGateway before 4.0.051230, allows remote attackers to execute arbitrary code via an HTTP request with a negative Content-Length field.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 18.60% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- broadcom/brightstor arcserve backup · broadcom/brightstor arcserve backup laptops desktops · broadcom/brightstor portal · broadcom/brightstor process automation manager · broadcom/brightstor san manager · broadcom/brightstor storage resource manager · broadcom/etrust admin · broadcom/etrust audit aries · broadcom/etrust audit irecorder · broadcom/etrust identity minder · broadcom/etrust integrated threat management · broadcom/itechnology igateway · broadcom/unicenter asset portfolio management · broadcom/unicenter autosys jm · broadcom/unicenter service delivery · broadcom/unicenter service desk · broadcom/unicenter service desk knowledge tools · broadcom/unicenter service fulfillment · broadcom/unicenter service metric analysis · ca/brightstor arcserve backup · +14 more
- Source
- cve@mitre.org
References
- http://marc.info/?l=full-disclosure&m=113803349715927&w=2
- http://secunia.com/advisories/18591Patch, Vendor Advisory
- http://securityreason.com/securityalert/380
- http://securitytracker.com/id?1015526Patch
- http://supportconnectw.ca.com/public/ca_common_docs/igatewaysecurity_notice.aspPatch, Vendor Advisory
- http://www.idefense.com/intelligence/vulnerabilities/display.php?id=376Patch, Vendor Advisory
- http://www.osvdb.org/22688Patch
- http://www.securityfocus.com/archive/1/423288/100/0/threaded
- http://www.securityfocus.com/archive/1/423403/100/0/threaded
- http://www.securityfocus.com/bid/16354Patch
- http://www.vupen.com/english/advisories/2006/0311Vendor Advisory
- http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33778
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24269
- http://marc.info/?l=full-disclosure&m=113803349715927&w=2
- http://secunia.com/advisories/18591Patch, Vendor Advisory
- http://securityreason.com/securityalert/380
- http://securitytracker.com/id?1015526Patch
- http://supportconnectw.ca.com/public/ca_common_docs/igatewaysecurity_notice.aspPatch, Vendor Advisory
- http://www.idefense.com/intelligence/vulnerabilities/display.php?id=376Patch, Vendor Advisory
- http://www.osvdb.org/22688Patch
- http://www.securityfocus.com/archive/1/423288/100/0/threaded
- http://www.securityfocus.com/archive/1/423403/100/0/threaded
- http://www.securityfocus.com/bid/16354Patch
- http://www.vupen.com/english/advisories/2006/0311Vendor Advisory
- http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33778
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24269
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.