Computer Associates ARCserve Backup Message Engine Denial of Service Vulnerability

Bugtraq ID:	35396
Class:	Design Error
CVE:	CVE-2009-1761
Remote:	Yes
Local:	No
Published:	Jun 16 2009 12:00AM
Updated:	Jun 16 2009 05:49PM
Credit:	iViZ Security Research Team
Vulnerable:	Computer Associates BrightStor ARCServe Backup r12.0 Windows SP1 Computer Associates BrightStor ARCServe Backup r12.0 Windows
Not Vulnerable:

Computer Associates ARCserve Backup Message Engine Denial of Service Vulnerability

Computer Associates ARCserve Backup is prone to multiple denial-of-service vulnerabilities.

Attackers can exploit these issues to crash the affected application, denying service to legitimate users.

The following applications are affected:

CA ARCserve Backup r12.0 Windows
CA ARCserve Backup r12.0 SP 1 Windows

Computer Associates ARCserve Backup Message Engine Denial of Service Vulnerability

An attacker can use readily available network utilities to exploit these issues.

Computer Associates ARCserve Backup Message Engine Denial of Service Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

Computer Associates ARCserve Backup Message Engine Denial of Service Vulnerability

References:

• [IVIZ-09-003] CA ARCserve Denial of Service] (iViZ Security Research Team)
  
• [IVIZ-09-004] CA ARCserve Denial of Service (iViZ Security Research Team)
  
• CA20090615-01: Security Notice for CA ARCserve Backup Message Engine (Computer Associates)
  
• Computer Associates Homepage (Computer Associates)
  
• CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabiliti ("Williams, James K" )