CVE:CVE-2011-2667
CNNVD:CNNVD-201107-323
Computer Associates Total Defense是集成了反病毒、反间谍、网关安全、主机入侵防护系统等网络安全服务为一体的多层防护系统。
Computer Associates Total Defense和Gateway Security中存在代码执行漏洞。此漏洞位于响应端口8080上的入站HTTP请求的Icihttp.exe模块(CA Gateway Security for HTTP)中。由于URL解析例程中的故障复制循环算法，远程未验证用户可能造成可利用的堆破坏条件，可造成在Gateway Security服务中执行任意代码。
solution:Upgrade broadcom total_defense to a higher version than r12,and avoid the version r12; Upgrade ca gateway_security to a higher version than 8.1,and avoid the version 8.1