Computer Associates BrightStor ARCserve Backup Stack Based Buffer Overflow Vulnerability
BID:62582
Info
Computer Associates BrightStor ARCserve Backup Stack Based Buffer Overflow Vulnerability
| Bugtraq ID: | 62582 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 04 2010 12:00AM |
| Updated: | Oct 04 2010 12:00AM |
| Credit: | Mario Ceballos |
| Vulnerable: |
Computer Associates BrightStor ARCServe Backup r11.5 Computer Associates BrightStor ARCServe Backup R11.1 |
| Not Vulnerable: | |
Discussion
Computer Associates BrightStor ARCserve Backup Stack Based Buffer Overflow Vulnerability
Computer Associates BrightStor ARCserve Backup is prone to a remote stack-based buffer-overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data.
An attacker can leverage this issue to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.
Computer Associates BrightStor ARCserve Backup r11.1 and r11.5 are vulnerable; other versions may also be affected.
Computer Associates BrightStor ARCserve Backup is prone to a remote stack-based buffer-overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data.
An attacker can leverage this issue to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.
Computer Associates BrightStor ARCserve Backup r11.1 and r11.5 are vulnerable; other versions may also be affected.
Exploit / POC
Computer Associates BrightStor ARCserve Backup Stack Based Buffer Overflow Vulnerability
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
Solution / Fix
Computer Associates BrightStor ARCserve Backup Stack Based Buffer Overflow Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Computer Associates BrightStor ARCserve Backup Stack Based Buffer Overflow Vulnerability
References:
References:
- BrightStor ARCserve Backup Product Page (Computer Associates)
- Disambiguate tape_engine_8A as tape_engine_0x8a (rapid7)