SupportConnect - BrightStor ARCserve Backup Security Notice
Support Connect   
SupportConnect Home
 
Knowledge Base
Compatibilities
Product Home Pages
 
Published Solutions
Licensing
Virus Signatures
ToolBox
 
E-News
 
Support Services
CA User Groups

BrightStor ARCserve Backup
Security Notice

Last Updated: October 11, 2007

CA's technical support is alerting customers to security risks associated with BrightStor ARCserve Backup. Multiple vulnerabilities exist that can allow a remote attacker to cause a denial of service, execute arbitrary code, or take privileged action. CA has issued patches to address the vulnerabilities.

The first set of vulnerabilities, CVE-2007-5325, CVE-2007-5326, and CVE-2007-5327, occur due to insufficient bounds checking by multiple components.

The second vulnerability, CVE-2007-5328, occurs due to privileged functions being available for use without proper authorization.

The third set of vulnerabilities, CVE-2007-5329, CVE-2007-5330, CVE-2007-5331, and CVE-2007-5332, are due to a memory corruption occurring with the processing of RPC procedure arguments by multiple services. The vulnerabilities allow an attacker to cause a denial of service, or potentially to execute arbitrary code.

Risk Rating

High

Affected Products

BrightStor ARCserve Backup r11.5
BrightStor ARCserve Backup r11.1
BrightStor ARCserve Backup r11 for Windows
BrightStor Enterprise Backup r10.5
BrightStor ARCserve Backup v9.01
CA Server Protection Suite r2
CA Business Protection Suite r2
CA Business Protection Suite for Microsoft Small Business Server Standard Edition r2
CA Business Protection Suite for Microsoft Small Business Server Premium Edition r2

How to determine if the installation is affected

  1. Using Windows Explorer, locate the file "mediasvr.exe". By default, the file is located in the "C:\Program Files\CA\BrightStor ARCserve Backup" directory.

  2. Right click on the file and select Properties.

  3. Select the General tab.

  4. If the file timestamp is earlier than indicated in the below table, the installation is vulnerable.


  5. Product Version File Name Timestamp File Size
    11.5 mediasvr.exe 06/28/2007 15:16:20 110592 bytes
    11.1 mediasvr.exe 07/02/2007 10:39:50 106496 bytes
    9.01 mediasvr.exe 07/02/2007 13:57:50 98304 bytes


    * For Protection Suites r2 , follow instructions for BrightStor ARCserve Backup r11.5

Solution

CA has issued the following patches to address the vulnerabilities.

BrightStor ARCserve Backup r11.5 - QO91094
BrightStor ARCserve Backup r11.1, - QO91097
BrightStor ARCserve Backup r11.0 - Upgrade to 11.1 and apply the latest patches.
BrightStor Enterprise Backup r10.5 - Upgrade to 11.5 and apply the latest patches.
BrightStor ARCserve Backup v9.01 - QO91098

CA Protection Suites r2: QO91094

Workaround

None

References

CVE-2007-5325 - Message Engine and AScore.dll buffer overflows
CVE-2007-5326 - RPC and rpcx.dll buffer overflows
CVE-2007-5327 - Message Engine buffer overflows
CVE-2007-5328 - Privileged function exposure
CVE-2007-5329 - dbasvr memory corruption
CVE-2007-5330 - RPC service memory corruption
CVE-2007-5331 - lqserver and media server memory corruption
CVE-2007-5332 - mediasvr and caloggerd memory corruption

Acknowledgement

CVE-2007-5325 - An anonymous researcher working with the iDefense VCP
CVE-2007-5326 - Dyon Balding of Secunia Research
CVE-2007-5327 - cocoruder of Fortinet Security Research Team
CVE-2007-5328 - Tenable Network Security
CVE-2007-5329 - Pedram Amini of DV Labs (dvlabs.tippingpoint.com)
CVE-2007-5330 - Dyon Balding of Secunia Research
CVE-2007-5331 - eEye Digital Security
CVE-2007-5332 - shirkdog

If additional information is required, please contact CA Technical Support at http://supportconnect.ca.com.

If you discover a vulnerability in CA products, please report your findings to vuln AT ca DOT com, or utilize our "Submit a Vulnerability" form at http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx.

 
PAGE TOOLS