[NT] Computer Associates BrightStor ARCserve Backup UniversalAgent Buffer Overflow
SecuriTeam <[email protected]>
| Newsgroups | gmane.comp.security.securiteam |
|---|---|
| Message-ID | <[email protected]> |
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source. http://www.securiteam.com/mailinglist.html - - - - - - - - - Computer Associates BrightStor ARCserve Backup UniversalAgent Buffer Overflow ------------------------------------------------------------------------ SUMMARY BrightStor ARCserve Backup provides backup and restore protection for all classes of Windows, NetWare, Linux and UNIX servers, as well as Windows, Mac OS X, Linux, UNIX, AS/400 and VMS client environments. Remote exploitation of a buffer overflow vulnerability in Computer Associates International Inc's BrightStor ARCserve Backup UniversalAgent may allow attackers to execute arbitrary code. DETAILS Vulnerable Systems: * Computer Associates BrightStor ARCserve Backup v11 The BrightStor software uses a network agent to perform backups on nodes across the network. This agent service requires either administrative credentials or a node-specific password and is capable of backing up system settings as well as files. This agent will listen on TCP and UDP ports 6050 by default. When an agent request is received on the TCP port, with the "option" field set to 0, 3 or 1000, and a large string preceding this "option"field in the packet, an overflow will occur. The agent software includes its own exception handler, preventing the service from actually crashing. Each time an exception occurs due to this overflow, the handler will kick in and restore the service back to an operating state. This particular overflow will cause three exceptions, two of which are non-exploitable, and one which can be used to hijack execution. Analysis: Successful exploitation of this vulnerability allows for a remote unauthenticated compromise with system level access. Although exploitation of this vulnerability is not trivial, it has been shown that it can be done reliably. Workaround: Employ firewalls, access control lists or other TCP/UDP restriction mechanism to limit access to systems and services. Vendor Status: Vendor advisories and patches for this vulnerability are available at: BrightStor ARCserve Backup r11.1 for Windows (all components): <http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66526&startsearch=1> http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66526&startsearch=1 BrightStor ARCserve Backup r11.1 Client Agent for Windows only: http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66527& startsearch=1 BrightStor ARCserve Backup r11.1 for Windows - 64 bit edition: <http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66534&startsearch=1> http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66534&startsearch=1 BrightStor ARCserve Backup r11.0 for Windows: <http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66525&startsearch=1> http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66525&startsearch=1 BrightStor ARCserve Backup r11.0 for Windows - 64 bit edition: <http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66535&startsearch=1> http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66535&startsearch=1 BrightStor ARCserve Backup v9.01 for Windows English (all components): <http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66528&startsearch=1> http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66528&startsearch=1 BrightStor ARCserve Backup v9.01 for Windows Non-English (all components): <http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66529&startsearch=1> http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66529&startsearch=1 BrightStor ARCserve Backup v9.01 for Windows - 64 bit edition: <http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66536&startsearch=1> http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66536&startsearch=1 BrightStor ARCserve Backup v9.01 Client Agent for Windows only (English): <http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66530&startsearch=1> http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66530&startsearch=1 BrightStor ARCserve Backup v9.01 Client Agent for Windows only (Non-English): <http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66531&startsearch=1> http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66531&startsearch=1 BrightStor Enterprise Backup v10.5 for Windows: <http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66524&startsearch=1> http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66524&startsearch=1 BrightStor Enterprise Backup v10.5 for Windows - 64 bit edition: <http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66533&startsearch=1> http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66533&startsearch=1 BrightStor Enterprise Backup v10.0 for Windows: <http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66523&startsearch=1 > http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=QO66523&startsearch=1 CVE Information: <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1018> CAN-2005-1018 Disclosure Timeline: 12/02/2004 - Initial vendor notification 12/02/2004 - Initial vendor response 04/11/2005 - Coordinated public disclosure ADDITIONAL INFORMATION The information has been provided by <mailto:[email protected]> iDEFENSE Labs. The original article can be found at: <http://www.idefense.com/application/poi/display?id=232&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=232&type=vulnerabilities ======================================== This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] In order to subscribe to the mailing list, simply forward this email to: [email protected] ==================== ==================== DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.