MediumPublic exploit

Buffer Overflow in CA License Client and Server 0.1.0.15

IdentifiersCVE-2005-0581CWE-120

Multiple buffer overflow vulnerabilities exist in Computer Associates (CA) License Client and Server version 0.1.0.15. These vulnerabilities can be triggered by sending specially crafted GCR requests with overly long fields in the Checksum item, IP address, hostname, or netmask values, as well as by sending a GETCONFIG packet with a long last parameter, or requests with invalid formats containing long values. These flaws allow remote attackers to overwrite memory and potentially execute arbitrary code on the affected system.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the License Client or Server process, leading to full system compromise. This can result in unauthorized access, data theft, or further network penetration.

Mitigation

If you can’t patch tonight, do this now.

Restrict network access to the License Client and Server to trusted hosts only, and use network-level controls such as firewalls to limit exposure. Monitor for abnormal traffic and consider disabling the vulnerable service if it is not required until a patch is applied.

Remediation

Patch, then assume compromise.

Upgrade to a patched version of CA License Client and Server that addresses these buffer overflow vulnerabilities. If a patch is not available, contact the vendor for further guidance.

PUBLIC EXPLOITS

Exploits

3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 3 / 4 TOTALView more in app

license_gcr.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit exploit module targeting a stack buffer overflow vulnerability (CVE-2005-0581) in Computer Associates BrightStor ARCserve Backup 11.0's license service (lic98rmtd.exe). The exploit connects to the target on TCP port 10202 and sends a specially crafted 'A0 GCR NETWORK' request containing a buffer that overflows the stack and allows execution of arbitrary code. The module supports custom payloads via the Metasploit framework and targets Windows 2003 SP0 English and Windows 2000 SP4 English systems. The code is written in Ruby and follows the standard Metasploit module structure, making it operational and ready for use within the framework. The only fingerprintable endpoint is the TCP port 10202, which is the default for the vulnerable service.

Disclosed Mar 2, 2005rubynetwork

calicclnt_getconfig.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit exploit module targeting a buffer overflow vulnerability (CVE-2005-0581) in the Computer Associates License Client service. The exploit works by connecting to the service on TCP port 10203, sending a crafted GETSERVER command, and then acting as a fake license server to receive a callback from the target. It then sends a specially crafted GETCONFIG command containing a buffer overflow and a customizable Metasploit payload (up to 600 bytes, avoiding null and space characters). The exploit supports multiple Windows targets (Windows 2000, XP, 2003) and requires the attacker's IP to be resolvable by the target. The module is operational and provides arbitrary code execution on the target system. The only file present is the Metasploit module itself, written in Ruby.

Disclosed Mar 2, 2005rubynetwork

calicserv_getconfig.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit exploit module targeting a stack buffer overflow vulnerability (CVE-2005-0581) in the Computer Associates License Server network service. The exploit works by sending a specially crafted, overly long 'GETCONFIG' packet to the service (default TCP port 10202), causing a stack overflow and allowing arbitrary code execution. The module supports multiple Windows targets (Windows 2000, XP SP0-2, 2003 English SP0) and allows the user to specify a custom payload (up to 600 bytes, avoiding null and space characters). The exploit is operational and can be used to gain remote code execution on vulnerable systems. The repository is structured as a single Ruby file compatible with the Metasploit Framework, and all exploit logic, including payload delivery and target selection, is contained within this file.

Disclosed Mar 2, 2005rubynetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

BroadcomLicense Softwareapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity