Signature Detail

APP: CA BrightStor ARCServe Backup LGServer Authentication Password Buffer Overflow

There exist two buffer overflow vulnerabilities in the way CA BrightStor ARCServe Backup for Laptops and Desktops service handles incoming messages. Specifically the vulnerabilities are due to lack of boundary check when processing user authentication requests. By sending specially crafted authentication request, an unauthenticated remote attacker can leverage these flaws to execute arbitrary code on the target host with System privileges. In an attack case where code injection is not successful, the affected service will terminate unexpectedly. This will create a denial of service condition of the affected service. In a more sophisticated attack where code injection results in successful process flow diverting, the behaviour of the target is entirely dependent on the intended function of the injected code. The code in such a case would execute within the security context of the running process, normally System.

Extended Description

Computer Associates ARCserve Backup for Laptops & Desktops is prone to multiple remote buffer-overflow vulnerabilities because the application fails to bounds-check user-supplied input before copying it into an insufficiently sized memory buffer. Successfully exploiting these issues allows remote attackers to execute arbitrary machine code with SYSTEM-Level privileges. This will result in a complete compromise of affected computers. ARCserve Backup for Laptops & Desktops r11.1 is reported vulnerable.

Affected Products

• Computer Associates ARCserve Backup for Laptops and Desktops 11.0
• Computer Associates ARCserve Backup for Laptops and Desktops 11.1
• Computer Associates ARCserve Backup for Laptops and Desktops 11.1 SP1
• Computer Associates ARCserve Backup for Laptops and Desktops 11.1 SP2
• Computer Associates ARCserve Backup for Laptops and Desktops 11.5
• Computer Associates Desktop Management Suite 11.1
• Computer Associates Desktop Management Suite 11.2
• Computer Associates Protection Suites r2

References

• BugTraq: 24348
• CVE: CVE-2007-5004