Signature Detail

APP: CA BrightStor ARCServe Backup LGServer Authentication Username Overflow

A stack-based buffer overflow vulnerability exists in CA BrightStor ARCServe Backup for Laptops and Desktops. The vulnerability is due to insufficient bounds checking in the LGServer process while performing authentication of users. A remote unauthenticated attacker could exploit this vulnerability by sending an overly large user name to the vulnerable service, and could inject and execute arbitrary code with System privileges. In an attack case where code injection is not successful, the affected service will terminate unexpectedly. This will create a denial of service condition of the affected service only. In a more sophisticated attack where code injection results in successful process flow diverting, the behaviour of the target is entirely dependent on the intended function of the injected code. The code in such a case would execute within the security context of the running process, normally System.

Extended Description

Computer Associates ARCserve Backup for Laptops & Desktops is prone to multiple remote buffer-overflow vulnerabilities because the application fails to bounds-check user-supplied input before copying it into an insufficiently sized memory buffer. Successfully exploiting these issues allows remote attackers to execute arbitrary machine code with SYSTEM-Level privileges. This will result in a complete compromise of affected computers. ARCserve Backup for Laptops & Desktops r11.1 is reported vulnerable.

Affected Products

• Computer Associates ARCserve Backup for Laptops and Desktops 11.0
• Computer Associates ARCserve Backup for Laptops and Desktops 11.1
• Computer Associates ARCserve Backup for Laptops and Desktops 11.1 SP1
• Computer Associates ARCserve Backup for Laptops and Desktops 11.1 SP2
• Computer Associates ARCserve Backup for Laptops and Desktops 11.5
• Computer Associates Desktop Management Suite 11.1
• Computer Associates Desktop Management Suite 11.2
• Computer Associates Protection Suites r2

References

• BugTraq: 24348
• CVE: CVE-2007-5003