CVE-2007-3302
CVE-2007-3302 is a critical-severity vulnerability in Broadcom Etrust Intrusion Detection with a CVSS 2.0 base score of 9.3. Its EPSS exploit-prediction score of 11% places it in the 95th percentile, indicating an elevated likelihood of exploitation.
Key facts
- Severity: Critical (CVSS 2.0 base score 9.3)
- EPSS exploit prediction: 11% (95th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Broadcom Etrust Intrusion Detection
- Published:
- Last modified:
Description
The CallCode ActiveX control in caller.dll 3.0 before 20070713, and 3.0 SP1 before 3.0.5.81, in CA (formerly Computer Associates) eTrust Intrusion Detection allows remote attackers to load arbitrary DLLs on a client system, and execute code from these DLLs, via unspecified "scriptable functions."
Frequently asked questions
- What is CVE-2007-3302?
- The CallCode ActiveX control in caller.dll 3.0 before 20070713, and 3.0 SP1 before 3.0.5.81, in CA (formerly Computer Associates) eTrust Intrusion Detection allows remote attackers to load arbitrary DLLs on a client system, and execute code from these DLLs, via unspecified "scriptable functions."
- How severe is CVE-2007-3302?
- CVE-2007-3302 has a CVSS 2.0 base score of 9.3, rated critical severity.
- Is CVE-2007-3302 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 11% (95th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2007-3302?
- CVE-2007-3302 primarily affects Broadcom Etrust Intrusion Detection. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2007-3302?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2007-3302 published?
- CVE-2007-3302 was published on 2007-07-26 and last updated on 2026-06-16.
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=568
- http://secunia.com/advisories/26134
- http://supportconnectw.ca.com/public/etrust/etrust_intrusion/infodocs/eid-callervilnsecnot.asp
- http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=149811
- http://www.securityfocus.com/archive/1/474599/100/0/threaded
- http://www.securityfocus.com/bid/25050
- http://www.securitytracker.com/id?1018447
- http://www.vupen.com/english/advisories/2007/2640
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35565
Affected products (3)
- cpe:2.3:a:broadcom:etrust_intrusion_detection:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:ca:etrust_intrusion_detection:3.0:sp1:*:*:*:*:*:*
- cpe:2.3:a:ca:etrust_intrusion_detection:3.05.81:*:*:*:*:*:*:*
More vulnerabilities in Broadcom Etrust Intrusion Detection
- CVE-2009-0042 — Critical (CVSS 10.0): Multiple unspecified vulnerabilities in the Arclib library (arclib.dll) before 7.3.0.15 in the CA Anti-Virus engine for…
- CVE-2005-1693 — Critical (CVSS 10.0): Integer overflow in Computer Associates Vet Antivirus library, as used by CA InoculateIT 6.0, eTrust Antivirus r6.0…
- CVE-2009-3587 — Critical (CVSS 9.3): Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise…
- CVE-2007-1005 — High (CVSS 7.8): Heap-based buffer overflow in SW3eng.exe in the eID Engine service in CA (formerly Computer Associates) eTrust…
- CVE-2004-0937 — High (CVSS 7.5): Sophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote…
- CVE-2004-0936 — High (CVSS 7.5): RAV antivirus allows remote attackers to bypass antivirus protection via a compressed file with both local and global…