ID: 3429
Date: 13 October 2007 19:11
Title: 3429 - CA BrightStor ARCserve Backup Security Advisory
Abstract: Description of a number of vulnerabilties in CA's BrightStor ARCserve Backup product
Vendors affected:CA
Applications affected:BrightStor ARCserve Backup Server
Adversity source: Unknown
Attack Vector: Vulnerability exploitation
Potential Damage: Remote execution/modification
Possible Duration: Open Ended
Availability of fix: Available
Type of fix: Patch
Source: CA
Reliability of source: Known
Source URL: http://supportconnectw.ca.com/public/storage/infodocs/basb-secnotice.asp
BrightStor ARCserve Backup
Security Notice
Last Updated: October 11, 2007
CA's technical support is alerting customers to security risks associated with BrightStor ARCserve Backup. Multiple vulnerabilities exist that can allow a remote attacker to cause a denial of service, execute arbitrary code, or take privileged action. CA has issued patches to address the vulnerabilities.
The first set of vulnerabilities, CVE-2007-5325, CVE-2007-5326, and CVE-2007-5327, occur due to insufficient bounds checking by multiple components.
The second vulnerability, CVE-2007-5328, occurs due to privileged functions being available for use without proper authorization.
The third set of vulnerabilities, CVE-2007-5329, CVE-2007-5330, CVE-2007-5331, and CVE-2007-5332, are due to a memory corruption occurring with the processing of RPC procedure arguments by multiple services. The vulnerabilities allow an attacker to cause a denial of service, or potentially to execute arbitrary code.
Risk Rating
High
Affected Products
BrightStor ARCserve Backup r11.5
BrightStor ARCserve Backup r11.1
BrightStor ARCserve Backup r11 for Windows
BrightStor Enterprise Backup r10.5
BrightStor ARCserve Backup v9.01
CA Server Protection Suite r2
CA Business Protection Suite r2
CA Business Protection Suite for Microsoft Small Business Server Standard Edition r2
CA Business Protection Suite for Microsoft Small Business Server Premium Edition r2
How to determine if the installation is affected
Using Windows Explorer, locate the file "mediasvr.exe". By default, the file is located in the "C:\Program Files\CA\BrightStor ARCserve Backup" directory.
Right click on the file and select Properties.
Select the General tab.
If the file timestamp is earlier than indicated in the below table, the installation is vulnerable.
Product Version File Name Timestamp File Size
11.5 mediasvr.exe 06/28/2007 15:16:20 110592 bytes
11.1 mediasvr.exe 07/02/2007 10:39:50 106496 bytes
9.01 mediasvr.exe 07/02/2007 13:57:50 98304 bytes
* For Protection Suites r2 , follow instructions for BrightStor ARCserve Backup r11.5
Solution
CA has issued the following patches to address the vulnerabilities.
BrightStor ARCserve Backup r11.5 - QO91094
BrightStor ARCserve Backup r11.1, - QO91097
BrightStor ARCserve Backup r11.0 - Upgrade to 11.1 and apply the latest patches.
BrightStor Enterprise Backup r10.5 - Upgrade to 11.5 and apply the latest patches.
BrightStor ARCserve Backup v9.01 - QO91098
CA Protection Suites r2: QO91094
Workaround
None
References
CVE-2007-5325 - Message Engine and AScore.dll buffer overflows
CVE-2007-5326 - RPC and rpcx.dll buffer overflows
CVE-2007-5327 - Message Engine buffer overflows
CVE-2007-5328 - Privileged function exposure
CVE-2007-5329 - dbasvr memory corruption
CVE-2007-5330 - RPC service memory corruption
CVE-2007-5331 - lqserver and media server memory corruption
CVE-2007-5332 - mediasvr and caloggerd memory corruption
Acknowledgement
CVE-2007-5325 - An anonymous researcher working with the iDefense VCP
CVE-2007-5326 - Dyon Balding of Secunia Research
CVE-2007-5327 - cocoruder of Fortinet Security Research Team
CVE-2007-5328 - Tenable Network Security
CVE-2007-5329 - Pedram Amini of DV Labs (dvlabs.tippingpoint.com)
CVE-2007-5330 - Dyon Balding of Secunia Research
CVE-2007-5331 - eEye Digital Security
CVE-2007-5332 - shirkdog
If additional information is required, please contact CA Technical Support at http://supportconnect.ca.com.
If you discover a vulnerability in CA products, please report your findings to vuln AT ca DOT com, or utilize our "Submit a Vulnerability" form at http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx.
This advisory contains information released by the original author. Some of the information may have changed since it was released. If the issue affects you, it may be prudent to retrieve the advisory from the site of the original source to ensure that you receive the most current information concerning that problem. Reference to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI.
The views and opinions of authors expressed within this notice shall not be used for advertising or product endorsement purposes. CPNI shall not accept responsibility for any errors or omissions contained within this advisory. In particular, they shall not be liable for any loss or damage whatsoever, arising from or in connection with the usage of information contained within this advisory.
CSIRTUK is a member of the Forum of Incident Response and Security Teams (FIRST) and has contacts with other international Incident Response Teams (IRTs) in order to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing amongst its members and the community at large.