CVE-2007-5331 Queue.dll for the message queuing service (LQserver.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows remote attackers to execute arbitrary code via a malf...
HighCVSS 10.0
EPSS 9.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Queue.dll for the message queuing service (LQserver.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows remote attackers to execute arbitrary code via a malformed ONRPC protocol request for operation 0x76, which causes ARCserve Backup to dereference arbitrary pointers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| broadcom brightstor arcserve backup | = 9.01 | No fix listed |
| broadcom brightstor arcserve backup | = 11.1 | No fix listed |
| broadcom brightstor arcserve backup | = 11.5 | No fix listed |
| broadcom brightstor enterprise backup | = 10.5 | No fix listed |
| broadcom business protection suite | = 2.0 | No fix listed |
| broadcom server protection suite | = 2 | No fix listed |
| ca brightstor arcserve backup | = 11 | No fix listed |
| ca business protection suite | = 2.0 | No fix listed |
References
- 41371 vdb-entry
- AD20071011 third-party-advisory
- 27192 third-party-advisory vendor-advisory
- supportconnectw.ca.com patch
- 20071011 EEYE: CA BrightStor ArcServe Backup Server Arbitrary Pointer Dereference mailing-list
- 20071011 [CAID 35724, 35725, 35726]: CA BrightStor ARCserve Backup Multiple Vulnerabilities mailing-list
- 24680 vdb-entry
- 1018805 vdb-entry
- ADV-2007-3470 vdb-entry vendor-advisory
- ca-brightstor-lqserver-code-execution(37071) vdb-entry