Computer Associates BrightStor ARCserve Backup Remote Buffer Overflow Vulnerability

BID:14453

Info

Computer Associates BrightStor ARCserve Backup Remote Buffer Overflow Vulnerability

Bugtraq ID: 14453
Class: Boundary Condition Error
CVE: CVE-2005-1272
Remote: Yes
Local: No
Published: Aug 02 2005 12:00AM
Updated: Nov 15 2007 12:40AM
Credit: An anonymous researcher discovered this issue.
Vulnerable: Computer Associates BrightStor Enterprise Backup Serverless Backup 10.5
Computer Associates BrightStor Enterprise Backup Serverless Backup 10.0
Computer Associates BrightStor Enterprise Backup for Windows 64 bit 10.5
Computer Associates BrightStor Enterprise Backup Agent for SQL 10.5
Computer Associates BrightStor Enterprise Backup Agent for SQL 10.0
Computer Associates BrightStor Enterprise Backup Agent for SAP R/3 10.5
Computer Associates BrightStor Enterprise Backup Agent for SAP R/3 10.0
Computer Associates BrightStor Enterprise Backup Agent for Oracle 10.5
Computer Associates BrightStor Enterprise Backup Agent for Oracle 10.0
Computer Associates BrightStor Enterprise Backup 10.5
Computer Associates BrightStor Enterprise Backup 10.0
Computer Associates BrightStor ARCServe Backup for Windows 64 bit 11.1
Computer Associates BrightStor ARCServe Backup for Windows 64 bit 11.0
Computer Associates BrightStor ARCServe Backup for Windows 64 bit 9.0.1
Computer Associates BrightStor ARCserve Backup for Windows (NoEng-Cli) 9.01
Computer Associates BrightStor ARCserve Backup for Windows (NoEng-All) 9.01
Computer Associates BrightStor ARCserve Backup for Windows (Eng-Cli) 9.01
Computer Associates BrightStor ARCserve Backup for Windows (Eng-All) 9.01
Computer Associates BrightStor ARCserve Backup for Windows (Client) 11.1
Computer Associates BrightStor ARCserve Backup for Windows (All) 11.1
Computer Associates BrightStor ARCServe Backup for Windows 11.1
Computer Associates BrightStor ARCServe Backup for Windows 11.0
Computer Associates BrightStor ARCServe Backup for Windows 9.0 .0.1
Computer Associates BrightStor ARCserve Backup for Oracle 11.1
Computer Associates BrightStor ARCserve Backup for Oracle 11.0
Computer Associates BrightStor ARCserve Backup for Oracle 9.0 1
Computer Associates BrightStor ARCserve Backup Agent for SQL 11.1
Computer Associates BrightStor ARCserve Backup Agent for SQL 11.0
Computer Associates BrightStor ARCserve Backup Agent for SQL 9.0 .0.1
Computer Associates BrightStor ARCserve Backup Agent for SAP R/3 11.1
Computer Associates BrightStor ARCserve Backup Agent for SAP R/3 11.0
Computer Associates BrightStor ARCserve Backup Agent for SAP R/3 9.0 1
Computer Associates BrightStor ARCserve Backup Agent for Exchange 11.1
Computer Associates BrightStor ARCserve Backup Agent for Exchange 11.0
Computer Associates BrightStor ARCserve Backup Agent for Exchange 9.0 1
Not Vulnerable:

Discussion

Computer Associates BrightStor ARCserve Backup Remote Buffer Overflow Vulnerability

Computer Associates BrightStor ARCserve Backup and BrightStor Enterprise Backup Agents for Windows are affected by a remote stack-based buffer-overflow vulnerability because the application fails to perform proper bounds checking on data supplied to the application.

A remote attacker may exploit this issue to execute arbitrary code on a vulnerable computer with SYSTEM privileges. A denial-of-service condition may arise as well.

Exploit / POC

Computer Associates BrightStor ARCserve Backup Remote Buffer Overflow Vulnerability

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

[email protected] has provided exploit code CABrightStorSQL.c.

[email protected] has also provided exploit code CABrightStorSQL_exp.c.

Exploit code cabrightstor_sqlagent.pm has been released as part of the Metasploit Framework.

Solution / Fix

Computer Associates BrightStor ARCserve Backup Remote Buffer Overflow Vulnerability

Solution:
The vendor has released updates addressing this issue.

The vendor has reported that the patch for BrightStor ARCserve Backup r11.1 Agent for SQL for Windows (QO70767) did not fully address this issue. A new patch for BrightStor ARCserve Backup for Windows (QO71010) is available. Users are advised to apply the new patch immediately.


Computer Associates BrightStor ARCserve Backup for Windows (Eng-All) 9.01

Computer Associates BrightStor ARCserve Backup for Windows (Eng-Cli) 9.01

Computer Associates BrightStor ARCserve Backup for Windows (Client) 11.1

Computer Associates BrightStor ARCserve Backup for Windows (NoEng-All) 9.01

Computer Associates BrightStor ARCserve Backup for Windows (NoEng-Cli) 9.01

Computer Associates BrightStor ARCserve Backup for Windows (All) 11.1

Computer Associates BrightStor Enterprise Backup Agent for SQL 10.0

Computer Associates BrightStor Enterprise Backup 10.0

Computer Associates BrightStor Enterprise Backup Serverless Backup 10.0

Computer Associates BrightStor Enterprise Backup Agent for Oracle 10.0

Computer Associates BrightStor Enterprise Backup Agent for SAP R/3 10.0

Computer Associates BrightStor Enterprise Backup Serverless Backup 10.5

Computer Associates BrightStor Enterprise Backup Agent for SQL 10.5

Computer Associates BrightStor Enterprise Backup Agent for SAP R/3 10.5

Computer Associates BrightStor Enterprise Backup 10.5

Computer Associates BrightStor Enterprise Backup for Windows 64 bit 10.5

Computer Associates BrightStor Enterprise Backup Agent for Oracle 10.5

Computer Associates BrightStor ARCserve Backup Agent for SAP R/3 11.0

Computer Associates BrightStor ARCserve Backup Agent for SQL 11.0

Computer Associates BrightStor ARCserve Backup Agent for Exchange 11.0

Computer Associates BrightStor ARCServe Backup for Windows 64 bit 11.0

Computer Associates BrightStor ARCServe Backup for Windows 11.0

Computer Associates BrightStor ARCserve Backup for Oracle 11.0

Computer Associates BrightStor ARCserve Backup Agent for Exchange 11.1

Computer Associates BrightStor ARCserve Backup Agent for SAP R/3 11.1

Computer Associates BrightStor ARCserve Backup Agent for SQL 11.1

Computer Associates BrightStor ARCserve Backup for Oracle 11.1

Computer Associates BrightStor ARCServe Backup for Windows 64 bit 11.1

Computer Associates BrightStor ARCServe Backup for Windows 11.1

Computer Associates BrightStor ARCServe Backup for Windows 9.0 .0.1

Computer Associates BrightStor ARCserve Backup Agent for SAP R/3 9.0 1

Computer Associates BrightStor ARCserve Backup Agent for Exchange 9.0 1

Computer Associates BrightStor ARCserve Backup Agent for SQL 9.0 .0.1

Computer Associates BrightStor ARCserve Backup for Oracle 9.0 1

Computer Associates BrightStor ARCServe Backup for Windows 64 bit 9.0.1

References

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report