Sign-up

ID

VAR-200908-0478


CVE

CVE-2009-2740


TITLE

CA Host-Based Intrusion Prevention System of kmxIds.sys Service disruption in (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2009-002627

DESCRIPTION

kmxIds.sys before 7.3.1.18 in CA Host-Based Intrusion Prevention System (HIPS) 8.1 allows remote attackers to cause a denial of service (system crash) via a malformed packet. Computer Associates Host-Based Intrusion Prevention System is affected by a denial-of-service vulnerability because the application mishandles malformed user-supplied input. A remote attacker may exploit this issue to cause denial-of-service conditions. Host-Based Intrusion Prevention System 8.1 is affected by this issue; other versions may also be vulnerable. CA HIPS integrates functions such as firewall, intrusion detection, intrusion protection, operating system security and application control to provide centralized active security protection. -----BEGIN PGP SIGNED MESSAGE----- CA20090818-01: Security Notice for CA Host-Based Intrusion Prevention System Issued: August 18, 2009 CA's technical support is alerting customers to a security risk with CA Host-Based Intrusion Prevention System. CA has issued a patch to address the vulnerability. The vulnerability, CVE-2009-2740, is due to the kmxIds.sys driver not correctly handling certain malformed packets. An attacker can send a malicious packet that will cause a kernel crash. Using Windows Explorer, locate the file "kmxIds.sys". By default, the file is located in the "C:\Windows\system32\drivers\" directory. 2. Right click on the file and select Properties. 3. Select the Version tab. 4. If the file version is less than indicated in the below table, the installation is vulnerable. File Name Version Size(bytes) Date kmxIds.sys 7.3.1.18 163,840 June 03, 2009, 12:32:22 PM Solution CA has issued the following patch to address the vulnerability. References CVE-2009-2740 - HIPS kmxIds.sys remote crash http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2740 CA20090818-01: Security Notice for CA Host-Based Intrusion Prevention System (line may wrap) https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=21 4665 Acknowledgement CVE-2009-2740 - iViZ Security Research Team Change History Version 1.0: Initial Release If additional information is required, please contact CA Support at http://support.ca.com/ If you discover a vulnerability in CA products, please report your findings to the CA Product Vulnerability Response Team. (line may wrap) https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=17 7782 Kevin Kotas CA Product Vulnerability Response Team -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQEVAwUBSosQJJI1FvIeMomJAQFFEAf+IcKJCxu2tj2cO24u8Hp3nQIeCyAAJITU Fdsmn/RRDNKPXm6fCPVbeK7rnvCGRuSmEOXPT+H+Y8S5ruppUqf4kuehkvhaW3N+ m5xjiC4BnACtPO6HE2q4JelgAdb0mKWIWnbn6ydWXKvBKViUQU4cAirCxRw7zj7P lrfm+V6hun7s6FTF7IccdGTJDhxXOCo9Q++FGLaOvaXJiXSS+HvzTM7MzbAEa5yy TosaTPGrnYO8FzQz+P/HFlCYsD6IKjCfMy1C63Qp7xCFWZ6ltJSKEIUYLu/DJlWu z2JUzNXn4lqNXoDLOAuBHawMiJesPXshjFqFG0kdeRxvP4JMUhENOQ== =AsHd -----END PGP SIGNATURE----- . --------------------------------------------------------------------------------------------------- [ iViZ Security Advisory 09-005 19/08/2009 ] --------------------------------------------------------------------------------------------------- iViZ Techno Solutions Pvt. http://www.ivizsecurity.com ------------------------------------------------------------------------------------------ * Title: CA HIPS kmxids.sys Remote Kernel Vulnerability * Software: CA HIPS r8.1 --[ Synopsis: CA HIPS is a Host Based Intrusion Prevention System in which managed agents are deployed on individual hosts to be protected by the HIPS and controlled by the centralized console. --[ Affected Software: * CA HIPS r8.1 (possibly older versions too) Tested on: * Agent Product Version: 1.5.290 * Agent Engine Version: 1.5.286 --[ Technical description: When CA HIPS agent processes certain malformed IP packets, it fails to handle certain boundary condition during parsing and pattern matching of the packet. It is possible to force the kernel driver (kmxids.sys) responsible for analyzing each in/out packet to reference invalid/unmapped memory. The following information is obtained during crash analysis: ------ CURRENT_IRQL: 2 FAULTING_IP: kmxids+a2f4 f6b8c2f4 8a26 mov ah,byte ptr [esi] DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0xD1 TRAP_FRAME: f88ca4f4 -- (.trap 0xfffffffff88ca4f4) ErrCode = 00000000 eax=f88ca754 ebx=81f7415a ecx=00000003 edx=428c200c esi=6e96d603 edi=f6b83264 eip=f6b8c2f4 esp=f88ca568 ebp=f88ca574 iopl=0 nv up ei pl nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206 kmxids+0xa2f4: f6b8c2f4 8a26 mov ah,byte ptr [esi] ds:0023:6e96d603=?? Resetting default scope LAST_CONTROL_TRANSFER: from 804f7b9d to 80527bdc STACK_TEXT: f88ca0a8 804f7b9d 00000003 f88ca404 00000000 nt!RtlpBreakWithStatusInstruction f88ca0f4 804f878a 00000003 6e96d603 f6b8c2f4 nt!KiBugCheckDebugBreak+0x19 f88ca4d4 80540683 0000000a 6e96d603 00000002 nt!KeBugCheck2+0x574 f88ca4d4 f6b8c2f4 0000000a 6e96d603 00000002 nt!KiTrap0E+0x233 WARNING: Stack unwind information not available. Following frames may be wrong. f88ca574 f6b832e1 6e96d603 f6b83264 00000003 kmxids+0xa2f4 00000000 00000000 00000000 00000000 00000000 kmxids+0x12e1 ------ The issue can be used to create a Denial of Service condition on each of the host protected by affected versions of CA HIPS agent, however due to the nature of the vulnerability remote code execution is unlikely

Trust: 2.16

sources: NVD: CVE-2009-2740 // JVNDB: JVNDB-2009-002627 // BID: 36078 // VULHUB: VHN-40186 // PACKETSTORM: 80488 // PACKETSTORM: 80522

AFFECTED PRODUCTS

vendor:camodel:host-based intrusion prevention systemscope:eqversion:8.1

Trust: 2.4

vendor:computermodel:associates host-based intrusion prevention systemscope:eqversion:8.1

Trust: 0.3

vendor:computermodel:associates host-based intrusion prevention system cfscope:neversion:8.11

Trust: 0.3

sources: BID: 36078 // JVNDB: JVNDB-2009-002627 // CNNVD: CNNVD-200908-275 // NVD: CVE-2009-2740

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2009-2740
value: MEDIUM

Trust: 1.0

NVD: CVE-2009-2740
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200908-275
value: MEDIUM

Trust: 0.6

VULHUB: VHN-40186
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2009-2740
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-40186
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-40186 // JVNDB: JVNDB-2009-002627 // CNNVD: CNNVD-200908-275 // NVD: CVE-2009-2740

PROBLEMTYPE DATA

problemtype:CWE-399

Trust: 1.9

sources: VULHUB: VHN-40186 // JVNDB: JVNDB-2009-002627 // NVD: CVE-2009-2740

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 80488 // CNNVD: CNNVD-200908-275

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-200908-275

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2009-002627

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-40186

PATCH
title:214665url:https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=214665
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2009-002627

EXTERNAL IDS
db:NVDid:CVE-2009-2740
Trust: 3.0
db:JVNDBid:JVNDB-2009-002627
Trust: 0.8
db:BUGTRAQid:20090818 CA20090818-01: SECURITY NOTICE FOR CA HOST-BASED INTRUSION PREVENTION SYSTEM
Trust: 0.6
db:CNNVDid:CNNVD-200908-275
Trust: 0.6
db:BIDid:36078
Trust: 0.4
db:PACKETSTORMid:80488
Trust: 0.2
db:PACKETSTORMid:80522
Trust: 0.2
db:VULHUBid:VHN-40186
Trust: 0.1
sources:
            
            
            VULHUB: VHN-40186 // 
            
            
            
            BID: 36078 // 
            
            
            
            JVNDB: JVNDB-2009-002627 // 
            
            
            
            PACKETSTORM: 80488 // 
            
            
            
            PACKETSTORM: 80522 // 
            
            
            
            CNNVD: CNNVD-200908-275 // 
            
            
            
            NVD: CVE-2009-2740

REFERENCES
url:https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentid=214665
Trust: 2.1
url:http://www.securityfocus.com/archive/1/505881/100/0/threaded
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-2740
Trust: 0.9
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-2740
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/505881/100/0/threaded
Trust: 0.6
url: http://www.ivizsecurity.com/security-advisory-iviz-sr-09005.html
Trust: 0.4
url:http://www.ca.com/us/products/product.aspx?id=5785
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2009-2740
Trust: 0.2
url:http://support.ca.com/
Trust: 0.1
url:https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentid=17
Trust: 0.1
url:https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentid=21
Trust: 0.1
url:http://www.ivizsecurity.com
Trust: 0.1
sources:
            
            
            VULHUB: VHN-40186 // 
            
            
            
            BID: 36078 // 
            
            
            
            JVNDB: JVNDB-2009-002627 // 
            
            
            
            PACKETSTORM: 80488 // 
            
            
            
            PACKETSTORM: 80522 // 
            
            
            
            CNNVD: CNNVD-200908-275 // 
            
            
            
            NVD: CVE-2009-2740

CREDITS
Kevin Kotas
Trust: 0.7
sources:
            
            
            PACKETSTORM: 80488 // 
            
            
            
            CNNVD: CNNVD-200908-275

SOURCES
db:VULHUBid:VHN-40186
db:BIDid:36078
db:JVNDBid:JVNDB-2009-002627
db:PACKETSTORMid:80488
db:PACKETSTORMid:80522
db:CNNVDid:CNNVD-200908-275
db:NVDid:CVE-2009-2740

LAST UPDATE DATE
2025-04-10T23:09:14.973000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-40186date:2018-10-10T00:00:00
db:BIDid:36078date:2009-08-21T15:54:00
db:JVNDBid:JVNDB-2009-002627date:2010-12-27T00:00:00
db:CNNVDid:CNNVD-200908-275date:2009-08-21T00:00:00
db:NVDid:CVE-2009-2740date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE
db:VULHUBid:VHN-40186date:2009-08-19T00:00:00
db:BIDid:36078date:2009-08-18T00:00:00
db:JVNDBid:JVNDB-2009-002627date:2010-12-27T00:00:00
db:PACKETSTORMid:80488date:2009-08-18T22:20:51
db:PACKETSTORMid:80522date:2009-08-23T15:54:12
db:CNNVDid:CNNVD-200908-275date:2009-08-19T00:00:00
db:NVDid:CVE-2009-2740date:2009-08-19T17:30:01.093