CVE-2007-0168 The Tape Engine service in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allows remote attackers to execute....
HighCVSS 7.5
EPSS 20.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The Tape Engine service in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allows remote attackers to execute arbitrary code via certain data in opnum 0xBF in an RPC request, which is directly executed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| broadcom brightstor arcserve backup | <= 11.5 | No fix listed |
| broadcom brightstor arcserve backup | = 9.01 | No fix listed |
| broadcom brightstor enterprise backup | = 10.5 | No fix listed |
| broadcom business protection suite | = 2.0 | No fix listed |
References
- livesploit.com
- 31327 vdb-entry
- 23648 third-party-advisory
- 1017506 vdb-entry
- supportconnectw.ca.com patch
- VU#662400 third-party-advisory us-government-resource
- www.lssec.com
- 20070111 ZDI-07-002: CA BrightStor ARCserve Backup Tape Engine Code Execution Vulnerability mailing-list
- 20070111 LS-20061002 - Computer Associates BrightStor ARCserve Backup Remote Code Execution Vulnerability mailing-list
- 20070111 [CAID 34955, 34956, 34957, 34958, 34959, 34817]: CA BrightStor ARCserve Backup Multiple Overflow Vulnerabilities mailing-list
- 22010 vdb-entry
- ADV-2007-0154 vdb-entry
- www.zerodayinitiative.com exploit
- brightstor-tapeengine-code-execution(31442) vdb-entry