CVE-2008-1472 : Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as u

Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products including BrightStor ARCserve Backup R11.5, Desktop Management Suite r11.1 through r11.2, and Unicenter products r11.1 through r11.2, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long argument to the AddColumn method.

Published 2008-03-24 22:44:00

Updated 2018-10-11 20:34:57

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowExecute codeDenial of service

Products affected by CVE-2008-1472

Unicenter » Asset Management » Version: R11.1 Update C1
cpe:2.3:a:unicenter:asset_management:r11.1:c1:*:*:*:*:*:*
Matching versions
Unicenter » Asset Management » Version: R11.1 Update GA
cpe:2.3:a:unicenter:asset_management:r11.1:ga:*:*:*:*:*:*
Matching versions
Unicenter » Asset Management » Version: R11.1 Update A
cpe:2.3:a:unicenter:asset_management:r11.1:a:*:*:*:*:*:*
Matching versions
Unicenter » Asset Management » Version: R11.2
cpe:2.3:a:unicenter:asset_management:r11.2:*:*:*:*:*:*:*
Matching versions
Unicenter » Asset Management » Version: R11.2 Update A
cpe:2.3:a:unicenter:asset_management:r11.2:a:*:*:*:*:*:*
Matching versions
Unicenter » Asset Management » Version: R11.2 Update C1
cpe:2.3:a:unicenter:asset_management:r11.2:c1:*:*:*:*:*:*
Matching versions
Unicenter » Desktop Management Bundle » Version: R11.2
cpe:2.3:a:unicenter:desktop_management_bundle:r11.2:*:*:*:*:*:*:*
Matching versions
Unicenter » Desktop Management Bundle » Version: R11.2 Update A
cpe:2.3:a:unicenter:desktop_management_bundle:r11.2:a:*:*:*:*:*:*
Matching versions
Unicenter » Desktop Management Bundle » Version: R11.1 Update C1
cpe:2.3:a:unicenter:desktop_management_bundle:r11.1:c1:*:*:*:*:*:*
Matching versions
Unicenter » Desktop Management Bundle » Version: R11.1 Update GA
cpe:2.3:a:unicenter:desktop_management_bundle:r11.1:ga:*:*:*:*:*:*
Matching versions
Unicenter » Desktop Management Bundle » Version: R11.2 Update C1
cpe:2.3:a:unicenter:desktop_management_bundle:r11.2:c1:*:*:*:*:*:*
Matching versions
Unicenter » Desktop Management Bundle » Version: R11.1 Update A
cpe:2.3:a:unicenter:desktop_management_bundle:r11.1:a:*:*:*:*:*:*
Matching versions
Unicenter » Remote Control » Version: R11.2
cpe:2.3:a:unicenter:remote_control:r11.2:*:*:*:*:*:*:*
Matching versions
Unicenter » Remote Control » Version: R11.2 Update A
cpe:2.3:a:unicenter:remote_control:r11.2:a:*:*:*:*:*:*
Matching versions
Unicenter » Remote Control » Version: R11.2 Update C1
cpe:2.3:a:unicenter:remote_control:r11.2:c1:*:*:*:*:*:*
Matching versions
Unicenter » Remote Control » Version: R11.1 Update A
cpe:2.3:a:unicenter:remote_control:r11.1:a:*:*:*:*:*:*
Matching versions
Unicenter » Remote Control » Version: R11.1 Update C1
cpe:2.3:a:unicenter:remote_control:r11.1:c1:*:*:*:*:*:*
Matching versions
Unicenter » Remote Control » Version: R11.1 Update GA
cpe:2.3:a:unicenter:remote_control:r11.1:ga:*:*:*:*:*:*
Matching versions
Unicenter » Software Delivery » Version: R11.1 Update A
cpe:2.3:a:unicenter:software_delivery:r11.1:a:*:*:*:*:*:*
Matching versions
Unicenter » Software Delivery » Version: R11.1 Update C1
cpe:2.3:a:unicenter:software_delivery:r11.1:c1:*:*:*:*:*:*
Matching versions
Unicenter » Software Delivery » Version: R11.1 Update GA
cpe:2.3:a:unicenter:software_delivery:r11.1:ga:*:*:*:*:*:*
Matching versions
Unicenter » Software Delivery » Version: R11.2
cpe:2.3:a:unicenter:software_delivery:r11.2:*:*:*:*:*:*:*
Matching versions
Unicenter » Software Delivery » Version: R11.2 Update A
cpe:2.3:a:unicenter:software_delivery:r11.2:a:*:*:*:*:*:*
Matching versions
Unicenter » Software Delivery » Version: R11.2 Update C1
cpe:2.3:a:unicenter:software_delivery:r11.2:c1:*:*:*:*:*:*
Matching versions
Computer Associates » Brightstor Arcserve Backup Laptops Desktops » Version: 11.5
cpe:2.3:a:computer_associates:brightstor_arcserve_backup_laptops_desktops:11.5:*:*:*:*:*:*:*
Matching versions
Computer Associates » Desktop Management Suite » Version: R11.1 Update A
cpe:2.3:a:computer_associates:desktop_management_suite:r11.1:a:*:*:*:*:*:*
Matching versions
Computer Associates » Desktop Management Suite » Version: R11.1 Update C1
cpe:2.3:a:computer_associates:desktop_management_suite:r11.1:c1:*:*:*:*:*:*
Matching versions
Computer Associates » Desktop Management Suite » Version: R11.1 Update GA
cpe:2.3:a:computer_associates:desktop_management_suite:r11.1:ga:*:*:*:*:*:*
Matching versions
Computer Associates » Desktop Management Suite » Version: R11.2
cpe:2.3:a:computer_associates:desktop_management_suite:r11.2:*:*:*:*:*:*:*
Matching versions
Computer Associates » Unicenter Dsm R11 List Control Atx » Version: 11.2.3.1895
cpe:2.3:a:computer_associates:unicenter_dsm_r11_list_control_atx:11.2.3.1895:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2008-1472

EPSS FAQ

93.60%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2008-1472

CA BrightStor ARCserve Backup AddColumn() ActiveX Buffer Overflow

Disclosure Date: 2008-03-16

First seen: 2020-04-26

exploit/windows/browser/ca_brightstor_addcolumn

The CA BrightStor ARCserve Backup ActiveX control (ListCtrl.ocx) is vulnerable to a stack-based buffer overflow. By passing an overly long argument to the AddColumn() method, a remote attacker could overflow a buffer and execute arbitrary code on the system. Authors

More information

CVSS scores for CVE-2008-1472

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2008-1472

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2008-1472

Jump to