CVE-2007-4620: CA Alert Notification Service stack buffer overflow via RPC

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw allows remote authenticated code execution with complete impact to confidentiality, integrity, and availability, and EPSS is very high, though no KEV listing or public exploit tags are present.

What it is

Multiple stack-based buffer overflows exist in Computer Associates Alert Notification Service (Alert.exe) versions 8.1.586.0, 8.0.450.0, and 7.1.758.0, which ship with several CA products including Anti-Virus for the Enterprise and Threat Manager for the Enterprise. A remote authenticated user can send crafted RPC requests to overflow a stack buffer and execute arbitrary code. The flaw is severe because successful exploitation yields full control of the affected service process.

Impact

An attacker who can authenticate and reach the RPC interface gains arbitrary code execution in the context of the Alert Notification Service, potentially leading to full compromise of the host and any data or credentials accessible to that service.

Attack surface

The vulnerability is reached over the network through the RPC interface of Alert.exe; the CVSS vector (AV:N/AC:L/Au:S) indicates network access with low complexity but requires the attacker to be authenticated. No user interaction is described.

Exploitation

The record shows no CISA KEV listing and no reference tags indicating public exploit code, but EPSS is high (0.52274, 98.9th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Apply the vendor patch or upgrade referenced in CA's security response (support.ca.com contentID=173103) for Alert.exe and all affected CA products.
• Restrict network access to the RPC interface used by Alert.exe to trusted hosts and authenticated users only.
• Disable or remove the Alert Notification Service on systems where it is not required.
• Monitor and limit RPC endpoint exposure on affected hosts, especially those running CA Anti-Virus for the Enterprise or Threat Manager for the Enterprise.

Detection

• Monitor for unusual or malformed RPC requests to the Alert.exe service, particularly from authenticated accounts that do not normally use it.
• Watch for process crashes or restarts of Alert.exe, which may indicate failed exploitation attempts.
• Correlate authentication logs with RPC traffic to identify anomalous access patterns to the Alert Notification Service.
• Use endpoint detection to flag unexpected child processes or code execution originating from Alert.exe.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.