CVE-2007-5328 The Message Engine RPC service in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows attackers to execute arbitrary code by using certain "insecure method calls" to...
HighCVSS 10.0
EPSS 7.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Message Engine RPC service in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows attackers to execute arbitrary code by using certain "insecure method calls" to modify the file system and registry, aka "Privileged function exposure."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| broadcom brightstor arcserve backup | = 9.01 | No fix listed |
| broadcom brightstor arcserve backup | = 10.5 | No fix listed |
| broadcom brightstor arcserve backup | = 11 | No fix listed |
| broadcom brightstor arcserve backup | = 11.1 | No fix listed |
| broadcom brightstor arcserve backup | = 11.5 | No fix listed |
| broadcom brightstor enterprise backup | = 10.5 | No fix listed |
References
- 27192 third-party-advisory
- supportconnectw.ca.com patch
- 20071011 [CAID 35724, 35725, 35726]: CA BrightStor ARCserve Backup Multiple Vulnerabilities mailing-list
- 20071126 ZDI-07-069: CA BrightStor ARCserve Backup Message Engine Insecure Method Exposure Vulnerability mailing-list
- 26015 vdb-entry
- 1018805 vdb-entry
- ADV-2007-3470 vdb-entry
- www.zerodayinitiative.com
- ca-brightstor-unspecified-security-bypass(37067) vdb-entry