CVE:CVE-2005-3653
CNNVD:CNNVD-200512-713
iTechnology是为第三方产品提供标准Web服务接口的集成技术。
iTechnology在处理HTTP请求头时存在堆溢出漏洞，远程攻击者可能利用此漏洞在主机上执行任意指令。iGateway服务在5250端口监听标准HTTP或SSL通讯。该服务没有正确地处理为负值的HTTP Content-Length字段。iGateway解析HTTP请求的Content-length字段值并直接在malloc()堆分配调用中使用了该值，因此如果提供了负数值的话，堆分配调用就会返回很小的缓冲区。malloc()调用之后，将提供的URI memcpy到所分配的缓冲区就会覆盖到堆。远程攻击者可以发送有很大URI和负值的Content-length字段的请求破坏堆，导致执行任意指令。
solution:Upgrade broadcom brightstor_arcserve_backup to a higher version than 9.01,11.1,11.5,and avoid the version 9.01,11.1,11.5; Upgrade broadcom brightstor_arcserve_backup_laptops_desktops to a higher version than 11.0,11.1,and avoid the version 11.0,11.1; Upgrade broadcom brightstor_portal to a higher version than 11.1,and avoid the version 11.1; Upgrade broadcom brightstor_process_automation_manager to a higher version than 11.1,and avoid the version 11.1; Upgrade broadcom brightstor_san_manager to a higher version than 11.1,11.5,and avoid the version 11.1,11.5; Upgrade broadcom brightstor_storage_resource_manager to a higher version than 6.3,6.4,11.1,11.5,and avoid the version 6.3,6.4,11.1,11.5; Upgrade broadcom etrust_admin to a higher version than 8.1,and avoid the version 8.1; Upgrade broadcom etrust_audit_aries to a higher version than 8.0,and avoid the version 8.0; Upgrade broadcom etrust_audit_irecorder to a higher version than 1.5:sp2,1.5:sp3,8.0,and avoid the version 1.5:sp2,1.5:sp3,8.0; Upgrade broadcom etrust_identity_minder to a higher version than 8.0,and avoid the version 8.0; Upgrade broadcom etrust_integrated_threat_management to a higher version than 8.0,and avoid the version 8.0; Upgrade broadcom itechnology_igateway to a higher version than 4.0.050615,and avoid the version (,4.0.050615]; Upgrade broadcom unicenter_asset_portfolio_management to a higher version than 11.0,and avoid the version 11.0; Upgrade broadcom unicenter_autosys_jm to a higher version than 11.0,and avoid the version 11.0; Upgrade broadcom unicenter_service_delivery to a higher version than 11.0,and avoid the version 11.0; Upgrade broadcom unicenter_service_desk to a higher version than 11.0,and avoid the version 11.0; Upgrade broadcom unicenter_service_desk_knowledge_tools to a higher version than 11.0,and avoid the version 11.0; Upgrade broadcom unicenter_service_fulfillment to a higher version than 2.2,and avoid the version 2.2; Upgrade broadcom unicenter_service_metric_analysis to a higher version than 11.0,and avoid the version 11.0; Upgrade ca brightstor_arcserve_backup to a higher version than 11,and avoid the version 11; Upgrade ca brightstor_enterprise_backup to a higher version than 10.0,10.5,and avoid the version 10.0,10.5; Upgrade ca etrust_audit_aries to a higher version than 1.5:sp2,1.5:sp3,and avoid the version 1.5:sp2,1.5:sp3; Upgrade ca etrust_directory to a higher version than 8.1_web_components,and avoid the version 8.1_web_components; Upgrade ca etrust_secure_content_manager to a higher version than 8.0,and avoid the version 8.0; Upgrade ca unicenter_application_performance_monitor to a higher version than 11.0,and avoid the version 11.0; Upgrade ca unicenter_application_server_managment to a higher version than 11.0,and avoid the version 11.0; Upgrade ca unicenter_ca_web_services_distributed_management to a higher version than 11.0,and avoid the version 11.0; Upgrade ca unicenter_exchange_management_console to a higher version than 11.0,and avoid the version 11.0; Upgrade ca unicenter_management to a higher version than 3.5,11.0,and avoid the version 3.5,11.0; Upgrade ca unicenter_service_catalog_fulfillment_accounting to a higher version than 11.0,and avoid the version 11.0; Upgrade ca unicenter_service_fulfillment to a higher version than 11.0,and avoid the version 11.0; Upgrade ca unicenter_service_level_management to a higher version than 11.0,and avoid the version 11.0; Upgrade ca unicenter_web_server_management to a higher version than 11.0,and avoid the version 11.0; Upgrade ca unicenter_web_services_distributed_management to a higher version than 11.0,and avoid the version 11.0