Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA…
Priority MEDIUM 50Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted RAR archive file that triggers heap corruption, a different vulnerability than CVE-2009-3588.
Why it matters now
EPSS 0.07605 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 51
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:broadcom:anti-virus:2007:8:*:*:*:*:*:* | 2007 8 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:anti-virus:2008:*:*:*:*:*:*:* | 2008 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:anti-virus_for_the_enterprise:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:anti-virus_for_the_enterprise:r8:*:*:*:*:*:*:* | r8 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:anti-virus_sdk:*:*:*:*:*:*:*:* | all versions | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:common_services:11:*:*:*:*:*:*:* | 11 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:common_services:11.1:*:*:*:*:*:*:* | 11.1 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:etrust_antivirus:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:etrust_antivirus:8:*:*:*:*:*:*:* | 8 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:etrust_antivirus:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Broadcom |
- cpe:2.3:a:broadcom:anti-virus:2007:8:*:*:*:*:*:* Versions 2007 8 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:anti-virus:2008:*:*:*:*:*:*:* Versions 2008 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:anti-virus_for_the_enterprise:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:anti-virus_for_the_enterprise:r8:*:*:*:*:*:*:* Versions r8 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:anti-virus_sdk:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:common_services:11:*:*:*:*:*:*:* Versions 11 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:common_services:11.1:*:*:*:*:*:*:* Versions 11.1 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:etrust_antivirus:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:etrust_antivirus:8:*:*:*:*:*:*:* Versions 8 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:etrust_antivirus:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Broadcom
Show 41 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:broadcom:etrust_integrated_threat_management:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:etrust_intrusion_detection:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:etrust_secure_content_manager:1.1:*:*:*:*:*:*:* | 1.1 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:internet_security_suite:*:*:*:*:*:*:*:* | all versions | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:internet_security_suite:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:network_and_systems_management:r3.0:*:*:*:*:*:*:* | r3.0 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:network_and_systems_management:r3.1:*:*:*:*:*:*:* | r3.1 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:network_and_systems_management:r11:*:*:*:*:*:*:* | r11 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:network_and_systems_management:r11.1:*:*:*:*:*:*:* | r11.1 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:secure_content_manager:1.1:*:*:*:*:*:*:* | 1.1 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:secure_content_manager:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:unicenter_network_and_systems_management:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:unicenter_network_and_systems_management:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:unicenter_network_and_systems_management:11:*:*:*:*:*:*:* | 11 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:unicenter_network_and_systems_management:11.1:*:*:*:*:*:*:* | 11.1 | Vulnerable | Broadcom |
| cpe:2.3:a:ca:anti-virus:2009:*:*:*:*:*:*:* | 2009 | Vulnerable | Ca |
| cpe:2.3:a:ca:anti-virus_for_the_enterprise:r8.1:*:*:*:*:*:*:* | r8.1 | Vulnerable | Ca |
| cpe:2.3:a:ca:anti-virus_gateway:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Ca |
| cpe:2.3:a:ca:anti-virus_plus:2009:*:*:*:*:*:*:* | 2009 | Vulnerable | Ca |
| cpe:2.3:a:ca:arcserve_backup:r11.5:*:*:*:*:*:*:* | r11.5 | Vulnerable | Ca |
| cpe:2.3:a:ca:arcserve_for_windows_client_agent:*:*:*:*:*:*:*:* | all versions | Vulnerable | Ca |
| cpe:2.3:a:ca:arcserve_for_windows_server_component:*:*:*:*:*:*:*:* | all versions | Vulnerable | Ca |
| cpe:2.3:a:ca:common_services:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | Ca |
| cpe:2.3:a:ca:etrust_anti-virus_gateway:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Ca |
| cpe:2.3:a:ca:etrust_anti-virus_sdk:*:*:*:*:*:*:*:* | all versions | Vulnerable | Ca |
| cpe:2.3:a:ca:etrust_ez_antivirus:r7.1:*:*:*:*:*:*:* | r7.1 | Vulnerable | Ca |
| cpe:2.3:a:ca:etrust_intrusion_detection:2.0:sp1:*:*:*:*:*:* | 2.0 sp1 | Vulnerable | Ca |
| cpe:2.3:a:ca:etrust_intrusion_detection:3.0:sp1:*:*:*:*:*:* | 3.0 sp1 | Vulnerable | Ca |
| cpe:2.3:a:ca:etrust_secure_content_manager:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Ca |
| cpe:2.3:a:ca:gateway_security:r8.1:*:*:*:*:*:*:* | r8.1 | Vulnerable | Ca |
| cpe:2.3:a:ca:internet_security_suite_2008:*:*:*:*:*:*:*:* | all versions | Vulnerable | Ca |
| cpe:2.3:a:ca:internet_security_suite_plus_2008:*:*:*:*:*:*:*:* | all versions | Vulnerable | Ca |
| cpe:2.3:a:ca:internet_security_suite_plus_2009:*:*:*:*:*:*:*:* | all versions | Vulnerable | Ca |
| cpe:2.3:a:ca:protection_suites:r2:*:*:*:*:*:*:* | r2 | Vulnerable | Ca |
| cpe:2.3:a:ca:protection_suites:r3:*:*:*:*:*:*:* | r3 | Vulnerable | Ca |
| cpe:2.3:a:ca:protection_suites:r3.1:*:*:*:*:*:*:* | r3.1 | Vulnerable | Ca |
| cpe:2.3:a:ca:threat_manager:8.1:*:enterprise:*:*:*:*:* | 8.1 | Vulnerable | Ca |
| cpe:2.3:a:ca:threat_manager:r8:*:enterprise:*:*:*:*:* | r8 | Vulnerable | Ca |
| cpe:2.3:a:ca:threat_manager_total_defense:*:*:*:*:*:*:*:* | all versions | Vulnerable | Ca |
| cpe:2.3:a:ca:arcserve_backup:r11.1:*:*:*:*:*:*:* | r11.1 | Vulnerable | Ca |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
- cpe:2.3:a:broadcom:etrust_integrated_threat_management:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:etrust_intrusion_detection:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:etrust_secure_content_manager:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:internet_security_suite:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:internet_security_suite:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:network_and_systems_management:r3.0:*:*:*:*:*:*:* Versions r3.0 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:network_and_systems_management:r3.1:*:*:*:*:*:*:* Versions r3.1 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:network_and_systems_management:r11:*:*:*:*:*:*:* Versions r11 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:network_and_systems_management:r11.1:*:*:*:*:*:*:* Versions r11.1 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:secure_content_manager:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:secure_content_manager:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:unicenter_network_and_systems_management:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:unicenter_network_and_systems_management:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:unicenter_network_and_systems_management:11:*:*:*:*:*:*:* Versions 11 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:unicenter_network_and_systems_management:11.1:*:*:*:*:*:*:* Versions 11.1 Vulnerable ·Broadcom
- cpe:2.3:a:ca:anti-virus:2009:*:*:*:*:*:*:* Versions 2009 Vulnerable ·Ca
- cpe:2.3:a:ca:anti-virus_for_the_enterprise:r8.1:*:*:*:*:*:*:* Versions r8.1 Vulnerable ·Ca
- cpe:2.3:a:ca:anti-virus_gateway:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Ca
- cpe:2.3:a:ca:anti-virus_plus:2009:*:*:*:*:*:*:* Versions 2009 Vulnerable ·Ca
- cpe:2.3:a:ca:arcserve_backup:r11.5:*:*:*:*:*:*:* Versions r11.5 Vulnerable ·Ca
- cpe:2.3:a:ca:arcserve_for_windows_client_agent:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Ca
- cpe:2.3:a:ca:arcserve_for_windows_server_component:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Ca
- cpe:2.3:a:ca:common_services:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Ca
- cpe:2.3:a:ca:etrust_anti-virus_gateway:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Ca
- cpe:2.3:a:ca:etrust_anti-virus_sdk:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Ca
- cpe:2.3:a:ca:etrust_ez_antivirus:r7.1:*:*:*:*:*:*:* Versions r7.1 Vulnerable ·Ca
- cpe:2.3:a:ca:etrust_intrusion_detection:2.0:sp1:*:*:*:*:*:* Versions 2.0 sp1 Vulnerable ·Ca
- cpe:2.3:a:ca:etrust_intrusion_detection:3.0:sp1:*:*:*:*:*:* Versions 3.0 sp1 Vulnerable ·Ca
- cpe:2.3:a:ca:etrust_secure_content_manager:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Ca
- cpe:2.3:a:ca:gateway_security:r8.1:*:*:*:*:*:*:* Versions r8.1 Vulnerable ·Ca
- cpe:2.3:a:ca:internet_security_suite_2008:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Ca
- cpe:2.3:a:ca:internet_security_suite_plus_2008:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Ca
- cpe:2.3:a:ca:internet_security_suite_plus_2009:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Ca
- cpe:2.3:a:ca:protection_suites:r2:*:*:*:*:*:*:* Versions r2 Vulnerable ·Ca
- cpe:2.3:a:ca:protection_suites:r3:*:*:*:*:*:*:* Versions r3 Vulnerable ·Ca
- cpe:2.3:a:ca:protection_suites:r3.1:*:*:*:*:*:*:* Versions r3.1 Vulnerable ·Ca
- cpe:2.3:a:ca:threat_manager:8.1:*:enterprise:*:*:*:*:* Versions 8.1 Vulnerable ·Ca
- cpe:2.3:a:ca:threat_manager:r8:*:enterprise:*:*:*:*:* Versions r8 Vulnerable ·Ca
- cpe:2.3:a:ca:threat_manager_total_defense:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Ca
- cpe:2.3:a:ca:arcserve_backup:r11.1:*:*:*:*:*:*:* Versions r11.1 Vulnerable ·Ca
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2009-3587
- 2026-10-03 Alias added: GHSA-q64c-hf5x-986j
References
Advisory 1
Other 1
Sources
- CVE-2009-3587 · CVE Program
- CVE-2009-3587 · NVD
- FIRST EPSS
- GHSA-q64c-hf5x-986j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences