Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and daemon crash) via a malformed request.
http://secunia.com/advisories/45332
http://securityreason.com/securityalert/8316
http://securitytracker.com/id?1025812
http://securitytracker.com/id?1025813
http://www.securityfocus.com/archive/1/518934/100/0/threaded
http://www.securityfocus.com/archive/1/518935/100/0/threaded
http://www.securityfocus.com/bid/48813
http://www.zerodayinitiative.com/advisories/ZDI-11-237/