CVE-2011-2667
Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 16.2%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and daemon crash) via a malformed request.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 16.20% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- broadcom/total defense · ca/gateway security
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/45332Vendor Advisory
- http://securityreason.com/securityalert/8316
- http://securitytracker.com/id?1025812
- http://securitytracker.com/id?1025813
- http://www.securityfocus.com/archive/1/518934/100/0/threaded
- http://www.securityfocus.com/archive/1/518935/100/0/threaded
- http://www.securityfocus.com/bid/48813
- http://www.zerodayinitiative.com/advisories/ZDI-11-237/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68736
- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B5E404992-6B58-4C44-A29D-027D05B6285D%7D
- http://secunia.com/advisories/45332Vendor Advisory
- http://securityreason.com/securityalert/8316
- http://securitytracker.com/id?1025812
- http://securitytracker.com/id?1025813
- http://www.securityfocus.com/archive/1/518934/100/0/threaded
- http://www.securityfocus.com/archive/1/518935/100/0/threaded
- http://www.securityfocus.com/bid/48813
- http://www.zerodayinitiative.com/advisories/ZDI-11-237/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68736
- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B5E404992-6B58-4C44-A29D-027D05B6285D%7D
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.