CVE-2005-3653

Published: Dec 31, 2005Modified: Apr 16, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Heap-based buffer overflow in the iGateway service for various Computer Associates (CA) iTechnology products, in iTechnology iGateway before 4.0.051230, allows remote attackers to execute arbitrary code via an HTTP request with a negative Content-Length field.

Affected (49)

Products: Broadcom: Brightstor Arcserve Backup, Brightstor Arcserve Backup Laptops Desktops, Brightstor Portal, Brightstor Process Automation Manager, Brightstor San Manager, Brightstor Storage Resource Manager, Etrust Admin, Etrust Audit Aries, Etrust Audit Irecorder, Etrust Identity Minder, Etrust Integrated Threat Management, Itechnology Igateway, Unicenter Asset Portfolio Management, Unicenter Autosys Jm, Unicenter Service Delivery, Unicenter Service Desk, Unicenter Service Desk Knowledge Tools, Unicenter Service Fulfillment, Unicenter Service Metric Analysis · Ca: Brightstor Arcserve Backup, Brightstor Enterprise Backup, Etrust Audit Aries, Etrust Directory, Etrust Secure Content Manager, Unicenter Application Performance Monitor, Unicenter Application Server Managment, Unicenter Ca Web Services Distributed Management, Unicenter Exchange Management Console, Unicenter Management, Unicenter Service Catalog Fulfillment Accounting, Unicenter Service Fulfillment, Unicenter Service Level Management, Unicenter Web Server Management, Unicenter Web Services Distributed Management

19 products

Brightstor Arcserve Backup

Brightstor Arcserve Backup Laptops Desktops

Brightstor Portal

Brightstor Process Automation Manager

Brightstor San Manager

Brightstor Storage Resource Manager

Etrust Audit Aries

Etrust Audit Irecorder

Etrust Identity Minder

Etrust Integrated Threat Management

Itechnology Igateway

Unicenter Asset Portfolio Management

Unicenter Autosys Jm

Unicenter Service Delivery

Unicenter Service Desk

Unicenter Service Desk Knowledge Tools

Unicenter Service Fulfillment

Unicenter Service Metric Analysis

15 products

Brightstor Arcserve Backup

Brightstor Enterprise Backup

Etrust Audit Aries

Etrust Directory

Etrust Secure Content Manager

Unicenter Application Performance Monitor

Unicenter Application Server Managment

Unicenter Ca Web Services Distributed Management

Unicenter Exchange Management Console

Unicenter Management

Unicenter Service Catalog Fulfillment Accounting

Unicenter Service Fulfillment

Unicenter Service Level Management

Unicenter Web Server Management

Unicenter Web Services Distributed Management

Configuration A

49 vulnerable

Vulnerable Software	Affected Versions
Broadcom Brightstor Arcserve Backup	Version 11.1
Broadcom Brightstor Arcserve Backup	Version 11.5
Broadcom Brightstor Arcserve Backup	Version 9.01
Broadcom Brightstor Arcserve Backup Laptops Desktops	Version 11.0
Broadcom Brightstor Arcserve Backup Laptops Desktops	Version 11.1
Broadcom Brightstor Portal	Version 11.1
Broadcom Brightstor Process Automation Manager	Version 11.1
Broadcom Brightstor San Manager	Version 11.1
Broadcom Brightstor San Manager	Version 11.5
Broadcom Brightstor Storage Resource Manager	Version 11.1
Broadcom Brightstor Storage Resource Manager	Version 11.5
Broadcom Brightstor Storage Resource Manager	Version 6.3
Broadcom Brightstor Storage Resource Manager	Version 6.4
Broadcom Etrust Admin	Version 8.1
Broadcom Etrust Audit Aries	Version 8.0
Broadcom Etrust Audit Irecorder	Version 1.5 sp2
Broadcom Etrust Audit Irecorder	Version 1.5 sp3
Broadcom Etrust Audit Irecorder	Version 8.0
Broadcom Etrust Identity Minder	Version 8.0
Broadcom Etrust Integrated Threat Management	Version 8.0
Broadcom Itechnology Igateway	Up to 4.0.050615
Broadcom Unicenter Asset Portfolio Management	Version 11.0
Broadcom Unicenter Autosys Jm	Version 11.0
Broadcom Unicenter Service Delivery	Version 11.0
Broadcom Unicenter Service Desk	Version 11.0
Broadcom Unicenter Service Desk Knowledge Tools	Version 11.0
Broadcom Unicenter Service Fulfillment	Version 2.2
Broadcom Unicenter Service Metric Analysis	Version 11.0
Ca Brightstor Arcserve Backup	Version 11
Ca Brightstor Enterprise Backup	Version 10.0
Ca Brightstor Enterprise Backup	Version 10.5
Ca Brightstor Enterprise Backup	Version 10.5
Ca Brightstor Enterprise Backup	Version 10.5
Ca Etrust Audit Aries	Version 1.5 sp2
Ca Etrust Audit Aries	Version 1.5 sp3
Ca Etrust Directory	Version 8.1_web_components
Ca Etrust Secure Content Manager	Version 8.0
Ca Unicenter Application Performance Monitor	Version 11.0
Ca Unicenter Application Server Managment	Version 11.0
Ca Unicenter Ca Web Services Distributed Management	Version 11.0
Ca Unicenter Exchange Management Console	Version 11.0
Ca Unicenter Management	Version 11.0
Ca Unicenter Management	Version 11.0
Ca Unicenter Management	Version 3.5
Ca Unicenter Service Catalog Fulfillment Accounting	Version 11.0
Ca Unicenter Service Fulfillment	Version 11.0
Ca Unicenter Service Level Management	Version 11.0
Ca Unicenter Web Server Management	Version 11.0
Ca Unicenter Web Services Distributed Management	Version 11.0

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (26)

http://marc.info/?l=full-disclosure&m=113803349715927&w=2

Source: cve@mitre.org

http://secunia.com/advisories/18591

Source: cve@mitre.org

PatchVendor Advisory

http://securityreason.com/securityalert/380

Source: cve@mitre.org

http://securitytracker.com/id?1015526

Source: cve@mitre.org

Patch

http://supportconnectw.ca.com/public/ca_common_docs/igatewaysecurity_notice.asp

Source: cve@mitre.org

PatchVendor Advisory

http://www.idefense.com/intelligence/vulnerabilities/display.php?id=376

Source: cve@mitre.org

PatchVendor Advisory

http://www.osvdb.org/22688

Source: cve@mitre.org

Patch

http://www.securityfocus.com/archive/1/423288/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/423403/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/16354

Source: cve@mitre.org

Patch

http://www.vupen.com/english/advisories/2006/0311

Source: cve@mitre.org

Vendor Advisory

http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33778

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/24269

Source: cve@mitre.org

http://marc.info/?l=full-disclosure&m=113803349715927&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/18591

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://securityreason.com/securityalert/380

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1015526

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://supportconnectw.ca.com/public/ca_common_docs/igatewaysecurity_notice.asp

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.idefense.com/intelligence/vulnerabilities/display.php?id=376

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.osvdb.org/22688

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securityfocus.com/archive/1/423288/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/423403/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/16354

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.vupen.com/english/advisories/2006/0311

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33778

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/24269

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.