Description
Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allow remote attackers to execute arbitrary code via RPC requests with crafted data for opnums (1) 0x2F and (2) 0x75 in the (a) Message Engine RPC service, or opnum (3) 0xCF in the Tape Engine service.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
CA BrightStor ARCserve Message Engine Buffer Overflow
exploit/windows/brightstor/message_engine
Exploit-DB 1
- CA BrightStor ARCserve - Message Engine Buffer Overflow (Metasploit) EDB-16418 · remote · Apr 30, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20070111 ZDI-07-003: CA BrightStor ARCserve Backup Message Engine Buffer Overflow Vulnerability mailing-list
- http://supportconnectw.ca.com/public/storage/infodocs/babimpsec-notice.asp
- brightstor-messageengine-rpc-bo(31443) vdb-entry
- http://www.zerodayinitiative.com/advisories/ZDI-07-004.html
- 1017506 vdb-entry
- 22006 vdb-entry
- 22005 vdb-entry
- 20070111 [CAID 34955, 34956, 34957, 34958, 34959, 34817]: CA BrightStor ARCserve Backup Multiple Overflow Vulnerabilities mailing-list
- 20070111 ZDI-07-004: CA BrightStor ARCserve Backup Tape Engine Buffer Overflow Vulnerability mailing-list
- 20070111 Computer Associates BrightStor ARCserve Backup RPC Engine PFC Request Buffer Overflow Vulnerability third-party-advisory
- ADV-2007-0154 vdb-entry
- 31327 vdb-entry
- VU#151032 third-party-advisory
- VU#180336 third-party-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-07-003.html
- brightstor-tapeengine-rpc-bo(31433) vdb-entry
- 23648 third-party-advisory