CVE-2011-2667

CA Total Defense r12 and Gateway Security 8.1 - Remote Code Execution via Malformed HTTP Request

Title source: llm
STIX 2.1

Description

Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and daemon crash) via a malformed request.

References (10)

Core 10
Core References
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-11-237/
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/518935/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1025812
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/8316
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/518934/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/48813
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/68736
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1025813
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/45332

Scores

EPSS 0.2524
EPSS Percentile 96.3%

Details

CWE
CWE-119
Status published
Products (2)
broadcom/total_defense r12
ca/gateway_security 8.1
Published Jul 28, 2011
Tracked Since Feb 18, 2026