[NT] CA BrightStor ARCserve Backup Agent For MS SQL Server Buffer Overflow

From: SecuriTeam (support_at_securiteam.com)
Date: 08/07/05

  • Next message: SecuriTeam: "[EXPL] Quick'n Easy FTP Server DoS (Exploit)" 
    To: list@securiteam.com
Date: 7 Aug 2005 18:28:22 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      CA BrightStor ARCserve Backup Agent For MS SQL Server Buffer Overflow
    ------------------------------------------------------------------------

    SUMMARY

    "BrightStor ARCserve Backup provides backup and restore protection for all
    classes of Windows, NetWare, Linux and UNIX servers, as well as Windows,
    Mac OS X, Linux, UNIX, AS/400 and VMS client environments". Remote
    exploitation of a buffer overflow vulnerability in Computer Associates
    International Inc's BrightStor ARCserve Backup UniversalAgent allow
    attackers to execute arbitrary code.

    DETAILS

    Vulnerable Systems:
     * CA BrightStor ARCserve Backup Agent for Microsoft SQL Server version
    11.0

    When a string with a length over 3168 bytes, is sent to the listening port
    (6070 by default) a stack based buffer overflow occurs. Successful
    exploitation allows remote attackers to execute arbitrary code with SYSTEM
    level privileges.

    Workaround:
    Restrict remote access at the network boundary, unless remote parties
    require service. Access to the affected host should be filtered at the
    network boundary if global accessibility is not required.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1272>
    CAN-2005-1272

    Disclosure Timeline:
    04/25/2005 - Initial vendor notification
    04/25/2005 - Initial vendor response
    08/02/2005 - Coordinated public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:idlabs-advisories@idefense.com> idefense.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?id=287&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=287&type=vulnerabilities.
    The vendor advisory can be found at:
    <http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33239>
    http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33239.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] Quick'n Easy FTP Server DoS (Exploit)"

    Relevant Pages

    • [NT] CA BrightStor ArcServe Media Server Multiple Buffer Overflow Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... User interaction is not required to exploit this vulnerability. ... BrightStor ARCserve Backup release 11.5 SP2 ...
      (Securiteam)
    • [EXPL] Windows RRAS Stack Overflow (Exploit, MS06-025)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... There is a remote code execution vulnerability in the Routing and Remote ... Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service ...
      (Securiteam)
    • [NEWS] Arkeia Network Backup Client Allows Unauthenticated Remote Access to Computer
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The Arkeia Network Backup Client allows a remote ... my $class = shift; ... sub Check { ...
      (Securiteam)
    • [NT] COOL! Remote Control DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... excellent remote computing system that is very easy to use. ... Remote Control 1.12 ... Control (server) component that could allow a remote attacker to crash the ...
      (Securiteam)
    • [NEWS] Apple QuickTime Multiple Vulnerabilities (PICT, Integer Overflow, DoS)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... vulnerabilities have been discovered in Apple's QuickTime. ... PICT Remote Memory Overwrite: ... Apple QuickTime PictureViewer is reported prone to remote memory overwrite ...
      (Securiteam)