[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

CSIRTUK ADVISORY - 3429 - CA - BrightStor ARCserve Backup Security Advisory



________________________________________________________________________


CSIRTUK ADVISORY - 3429 dated 13.10.07 time 19:11

Centre for the Protection of National Infrastructure (CPNI)

________________________________________________________________________

 Further details about CPNI, including information about our products
can be
 found at www.cpni.gov.uk

 Please note that CSIRTUK RSS Feeds are available from:
 http://www.cpni.gov.uk/rss/advisories.xml
________________________________________________________________________

Title
=====
CA BrightStor ARCserve Backup Security Advisory

Detail
======
ID: 3429
Date: 13 October 2007 19:11

------------------------------------------------------------------------
--------
Title: 3429 - CA BrightStor ARCserve Backup Security Advisory
Abstract: Description of a number of vulnerabilties in CA's BrightStor
ARCserve Backup product
Vendors affected:CA
Applications affected:BrightStor ARCserve Backup Server
Advisory type: Information
Adversity source: Unknown
Attack Vector: Vulnerability exploitation
Potential Damage: Remote unauthorised modification
Possible Duration: Open Ended
Availability of fix: Available
Type of fix: Patch
Source: CA
Reliability of source: Known
Source URL:
http://supportconnectw.ca.com/public/storage/infodocs/basb-secnotice.asp

BrightStor ARCserve Backup
Security Notice
Last Updated: October 11, 2007

CA's technical support is alerting customers to security risks
associated with BrightStor ARCserve Backup. Multiple vulnerabilities
exist that can allow a remote attacker to cause a denial of service,
execute arbitrary code, or take privileged action. CA has issued patches
to address the vulnerabilities.

The first set of vulnerabilities, CVE-2007-5325, CVE-2007-5326, and
CVE-2007-5327, occur due to insufficient bounds checking by multiple
components.

The second vulnerability, CVE-2007-5328, occurs due to privileged
functions being available for use without proper authorization.

The third set of vulnerabilities, CVE-2007-5329, CVE-2007-5330,
CVE-2007-5331, and CVE-2007-5332, are due to a memory corruption
occurring with the processing of RPC procedure arguments by multiple
services. The vulnerabilities allow an attacker to cause a denial of
service, or potentially to execute arbitrary code.

Risk Rating 

High

Affected Products 

BrightStor ARCserve Backup r11.5
BrightStor ARCserve Backup r11.1
BrightStor ARCserve Backup r11 for Windows
BrightStor Enterprise Backup r10.5
BrightStor ARCserve Backup v9.01
CA Server Protection Suite r2
CA Business Protection Suite r2
CA Business Protection Suite for Microsoft Small Business Server
Standard Edition r2
CA Business Protection Suite for Microsoft Small Business Server Premium
Edition r2

How to determine if the installation is affected 

Using Windows Explorer, locate the file "mediasvr.exe". By default, the
file is located in the "C:\Program Files\CA\BrightStor ARCserve Backup"
directory.


Right click on the file and select Properties.


Select the General tab.


If the file timestamp is earlier than indicated in the below table, the
installation is vulnerable.

Product Version File Name Timestamp File Size 
11.5 mediasvr.exe 06/28/2007 15:16:20 110592 bytes 
11.1 mediasvr.exe 07/02/2007 10:39:50 106496 bytes 
9.01 mediasvr.exe 07/02/2007 13:57:50 98304 bytes 


* For Protection Suites r2 , follow instructions for BrightStor ARCserve
Backup r11.5 
Solution

CA has issued the following patches to address the vulnerabilities. 


BrightStor ARCserve Backup r11.5 - QO91094
BrightStor ARCserve Backup r11.1, - QO91097
BrightStor ARCserve Backup r11.0 - Upgrade to 11.1 and apply the latest
patches.
BrightStor Enterprise Backup r10.5 - Upgrade to 11.5 and apply the
latest patches.
BrightStor ARCserve Backup v9.01 - QO91098

CA Protection Suites r2: QO91094

Workaround 

None

References 

CVE-2007-5325 - Message Engine and AScore.dll buffer overflows
CVE-2007-5326 - RPC and rpcx.dll buffer overflows
CVE-2007-5327 - Message Engine buffer overflows
CVE-2007-5328 - Privileged function exposure
CVE-2007-5329 - dbasvr memory corruption
CVE-2007-5330 - RPC service memory corruption
CVE-2007-5331 - lqserver and media server memory corruption
CVE-2007-5332 - mediasvr and caloggerd memory corruption

Acknowledgement

CVE-2007-5325 - An anonymous researcher working with the iDefense VCP
CVE-2007-5326 - Dyon Balding of Secunia Research
CVE-2007-5327 - cocoruder of Fortinet Security Research Team
CVE-2007-5328 - Tenable Network Security
CVE-2007-5329 - Pedram Amini of DV Labs (dvlabs.tippingpoint.com)
CVE-2007-5330 - Dyon Balding of Secunia Research
CVE-2007-5331 - eEye Digital Security
CVE-2007-5332 - shirkdog

If additional information is required, please contact CA Technical
Support at http://supportconnect.ca.com.

If you discover a vulnerability in CA products, please report your
findings to vuln AT ca DOT com, or utilize our "Submit a Vulnerability"
form at http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx.

________________________________________________________________________

CPNI values your feedback.

1. Which of the following most reflects the value of the advisory to
you?
(Place an 'X' next to your choice)

Very useful:__ Useful:__ Not useful:__

2. If you did not find it useful, why not?


3. Any other comments? How could we improve our advisories?


Thank you for your contribution.

________________________________________________________________________

CSIRTUK wishes to acknowledge the contributions of CA for the
information
contained in this advisory.
________________________________________________________________________

This advisory contains information released by the original author. Some
of the
information may have changed since it was released. If the issue affects
you,
it may be prudent to retrieve the advisory from the site of the original
source to ensure that you receive the most current information
concerning that
problem.

Reference to any specific commercial product, process, or service by
trade
name, trademark manufacturer, or otherwise, does not constitute or imply
its
endorsement, recommendation, or favouring by CPNI. The views and
opinions of
authors expressed within this notice shall not be used for advertising
or
product endorsement purposes.

CPNI shall not accept responsibility for any errors or omissions
contained
within this advisory. In particular, they shall not be liable for any
loss or
damage whatsoever, arising from or in connection with the usage of
information
contained within this advisory.

CSIRTUK is a member of the Forum of Incident Response and Security Teams
(FIRST)
and has contacts with other international Incident Response Teams (IRTs)
in
order to foster cooperation and coordination in incident prevention, to
prompt
rapid reaction to incidents, and to promote information sharing amongst
its
members and the community at large.
________________________________________________________________________

<End of CPNI Advisory>


The original of this email was scanned for viruses by the Government Secure Intranet Anti-Virus service supplied by Cable&Wireless in partnership with MessageLabs. (CCTM Certificate Number 2006/04/0007.) On leaving the GSi this email was certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.