Computer Associates (CA) BrightStor ARCserve Backup Mediasvr RPC buffer overflow (Sunrpc_BackupProduct_BO)

About this signature or vulnerability

Proventia Network MFS, IBM Security Server Protection for Windows, Proventia-G 1.1 and earlier, Proventia Network IDS, RealSecure Network, RealSecure Server Sensor, BlackICE Server Protection, BlackICE PC Protection, Proventia Network IPS, Proventia Desktop, Proventia Server IPS for Linux technology, RealSecure Desktop, Virtual Server Protection for Vmware:

This signature looks for A malformed XDR string in unique procedures.


Default risk level

High risk vulnerability  High

Sensors that have this signature

Proventia Network MFS: XPU 1.90, IBM Security Server Protection for Windows: 1.0.914.1910, IBM Security Server Protection for Windows: 2.1.14.2400, Proventia-G 1.1 and earlier: XPU 24.51, Proventia Network IDS: XPU 24.51, RealSecure Network: XPU 24.51, RealSecure Server Sensor: XPU 24.51, BlackICE Server Protection: 3.6.cpw, BlackICE PC Protection: 3.6cpw, Proventia Network IPS: XPU 1.90, Proventia Desktop: 1910, Proventia Server IPS for Linux technology: 1.90, RealSecure Desktop: epw, Virtual Server Protection for Vmware: 1.0

Systems affected

CA BrightStor ARCserve Backup for Windows: 11, CA BrightStor Enterprise Backup: 10.5, CA BrightStor ARCserve Backup: 11.1, CA Server Protection Suite: 2, CA Business Protection Suite: 2.0, CA BrightStor ARCserve Backup: 11.5, CA BrightStor ARCserve Backup: 9.01, CA Business Protection Suite for Microsoft Small Business Server: 2 Standard, CA Business Protection Suite for Microsoft Small Business Server: 2 Premium

Type

Unauthorized Access Attempt

Vulnerability description

Multiple Computer Associates (CA) BrightStor ARCserve backup products are vulnerable to a stack-based buffer overflow in the Mediasrv.exe service. By sending specially-crafted packets to the RPC interface on a vulnerable system, a remote attacker could overflow a buffer and execute arbitrary code on the system with SYSTEM privileges.

How to remove this vulnerability

Apply the appropriate fix for your system (QO84983, QO84984, QI82917, QO84986, or QO84985), available from the CA SupportConnect Web site. See References.

References

CA SupportConnect Web site
Important Security Notice for BrightStor ARCserve Backup
http://supportconnectw.ca.com/public/storage/infodocs/babimpsec-notice.asp

IBM Internet Security Systems Protection Advisory, Jan 11, 2006
Computer Associates Brightstor ARCserve Mediasvr.exe Overflow
http://www.iss.net/threats/252.html

ISS X-Force
Computer Associates (CA) BrightStor ARCserve Backup Mediasvr RPC buffer overflow
http://www.iss.net/security_center/static/29343.php

CVE
CVE-2006-5171
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5171