Description
The Tape Engine service in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allows remote attackers to execute arbitrary code via certain data in opnum 0xBF in an RPC request, which is directly executed.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- CA BrightStor ARCserve Backup - Message Engine/Tape Engine Remote Buffer Overflow EDB-29444 · dos · Jan 11, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://supportconnectw.ca.com/public/storage/infodocs/babimpsec-notice.asp
- http://livesploit.com/advisories/LS-20061002.pdf
- 22010 vdb-entry
- brightstor-tapeengine-code-execution(31442) vdb-entry
- 1017506 vdb-entry
- http://www.zerodayinitiative.com/advisories/ZDI-07-002.html
- 20070111 [CAID 34955, 34956, 34957, 34958, 34959, 34817]: CA BrightStor ARCserve Backup Multiple Overflow Vulnerabilities mailing-list
- 20070111 LS-20061002 - Computer Associates BrightStor ARCserve Backup Remote Code Execution Vulnerability mailing-list
- ADV-2007-0154 vdb-entry
- 31327 vdb-entry
- VU#662400 third-party-advisory
- 20070111 ZDI-07-002: CA BrightStor ARCserve Backup Tape Engine Code Execution Vulnerability mailing-list
- http://www.lssec.com/advisories/LS-20061002.pdf
- 23648 third-party-advisory