Re: [Full-disclosure] CA BrightStor ARCserve Backup Tape Engine Exploit Security Notice


[Full-disclosure] CA BrightStor ARCserve Backup Tape Engine
Exploit Security Notice
TheGesus thegesus at gmail.com
Wed Jan 10 16:38:47 GMT 2007

On 1/9/07, Williams, James K <James.Williams at ca.com> wrote:

[...]
CA BrightStor ARCserve Backup Tape Engine Exploit Security
Notice

CA is aware that exploit code for a vulnerability in the Tape
Engine component of CA BrightStor ARCserve Backup was posted on
several security web sites and mailing lists on January 5,
2007. This vulnerability is fixed in BrightStor ARCserve Backup
r11.5 Service Pack 2, and a patch for earlier versions of
ARCserve will be available shortly.
[...]
Reference (URL may wrap):
http://supportconnectw.ca.com/public/storage/infodocs/basbrtapeeng-secnotice.asp

Regards,
Ken

Ken Williams ; 0xE2941985
Director, CA Vulnerability Research
[...]


TRANSLATION: don't hold your breath waiting for a patch.


Agreed. Two days is quite a bit longer than the current
competitive static apnea world record of 9 min 04 sec.

Patches for all other releases of BrightStor ARCserve Backup are
now available via SupportConnect.
http://SupportConnect.ca.com

BAB r11.5 – QO84983
BAB r11.1 – QO84984
BAB r11.0 – QI82917
BEB r10.5 – QO84986
BAB v9.01 – QO84985

A formal advisory will be sent out later today.

Regards,
Ken

Ken Williams ; 0xE2941985
Director, CA Vulnerability Research

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages