Home

CA BrightStor ARCserve Backup Discovery Service Buffer Overflow

Notification Type:	IBM Internet Security Systems Protection Alert
Notification Date:	Dec 12, 2006
Notification Version:	1.0

Name:	CA BrightStor ARCserve Backup Discovery Service Buffer Overflow
Public disclosure/ In the wild date:	Dec 07, 2006 (vuln disclosed)
CVE:	CVE-2006-6379
Description:	Multiple Computer Associates (CA) BrightStor ARCserve Backup products are vulnerable to a buffer overflow in the Discovery Service. By sending a specially-crafted packet to the Discovery Service on vulnerable systems, a remote attacker could overflow a buffer and execute arbitrary code on the system with SYSTEM privileges.

ISS Coverage

Product	Content Version
Network Sensor 7.0 Proventia A Proventia IPS (G/GX) prior to Firmware Version 1.2 Server Sensor 7.0	24.53
Proventia IPS (G/GX) Firmware Version 1.2 or later Proventia Multifunction Appliance Proventia Server (Linux)	1.92
Proventia Server (Windows)	1.0.914.1930
Proventia Desktop	8.0.x.1930
RealSecure Desktop 7.0 (AM SP 6.76 or 7.76)	EPY
BlackICE PC Protection 3.6	CPY
Enterprise Scanner	tbd
Internet Scanner	tbd

Propagation Techniques

ISS Protection

Available

remote exploit

BrightStor_Discovery_Overflow*

BrightStor_Discovery_TCP_Overflow
BrightStor_Discovery_UDP_Overflow
BrightStor_Discovery_TCP_Query_Overflow
BrightStor_Discovery_UDP_Query_Overflow

* Due to close code proximity, this signature detected TCP variants of this issue. New signatures were added to cover UDP and to distinguish one type of vulnerability exploit attempt from another (query vs. message) for reporting purposes. This signature has been deprecated and renamed. See readme for details.

Jul 09, 2005

Dec 13, 2006
Dec 13, 2006
Dec 13, 2006
Dec 13, 2006

Detection Techniques	ISS Detection	Available
network assessment	tbd	est. Dec 14, 2006

Detailed Description

Business Impact:	A successful compromise of an affected version of Computer Associates ARCserve Backup leaves the attacker in complete control of the targeted host, which can result in exposure of confidential information, loss of productivity, and further network compromise.
CVSS:	Base Score:		10
		Access Vector:	Remote
		Access Complexity:	Low
		Authentication:	Not Required
		Confidentiality Impact:	Complete
		Integrity Impact:	Complete
		Availability Impact:	Complete
		Impact Bias:	Normal
	Adjusted Temporal Score:		7.7
		Exploitability:	Unproven
		Remediation Level:	Official Fix
		Report Confidence:	Confirmed
Affected Products:	Computer Associates: BrightStor ARCserve Backup r11.1 Computer Associates: BrightStor ARCserve Backup r11.5 SP1 and prior Computer Associates: BrightStor ARCserve Backup v9.01 Computer Associates: CA Business Protection Suite r2 Computer Associates: CA Business Protection Suite for MS Premium Edition r2 Computer Associates: CA Business Protection Suite for MS Standard Edition r2 Computer Associates: CA Server Protection Suite r2 Computer Associates, Inc.: BrightStor ARCserve Backup for Windows r11 Computer Associates, Inc.: BrightStor Enterprise Backup r10.5
Technical Description:	ARCserve Backup is vulnerable to a stack overflow when processing malformed packets. This vulnerability can be attacked remotely with either UDP or TCP traffic. A single UDP packet can exploit the vulnerability, so a network worm targeting the issue could spread rapidly.
Remedy:	Apply the appropriate fix for your system (QO81201, QO84609, QI82917, QO84611, or QO84610), available from the CA SupportConnect Web site. See References.

References

XFDB:	http://xforce.iss.net/xforce/xfdb/30791
CA:	http://supportconnectw.ca.com/public/storage/infodocs/babsecurity-notice.asp

Revision History

Dec 12, 2006:

Initial draft.

* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

About IBM Security Systems

IBM Security Systems include an extensive portfolio of hardware, software solutions, professional and managed services offerings covering the spectrum of IT and business security risks: people and identity, data and information, application and process, network, server and endpoint and physical infrastructure, empowering clients to innovate and operate their businesses on the most secure infrastructure platforms. Through world-class solutions that address risk across the enterprise, IBM helps organizations build a strong security posture that helps reduce costs, improve service, and manage risk. IBM X-Force(R) Research and Development is one of the most renowned commercial security research and development groups in the world. For more information on how to address today's biggest risks, please visit us at ibm.com/security.