CVE-2008-4397 Directory traversal vulnerability in the RPC interface (asdbapi.dll) in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to execute arbitrary comman...
HighCVSS 10.0
EPSS 80.5%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in the RPC interface (asdbapi.dll) in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to execute arbitrary commands via a .. (dot dot) in an RPC call with opnum 0x10A.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| broadcom arcserve backup | = r12.0 | No fix listed |
| broadcom business protection suite | = r2 | No fix listed |
| broadcom server protection suite | = r2 | No fix listed |
| ca arcserve backup | = r11.1 | No fix listed |
| ca arcserve backup | = r11.5 | No fix listed |
| ca business protection suite | = r2 | No fix listed |
References
- 32220 third-party-advisory vendor-advisory
- 4412 third-party-advisory
- 20081009 CA ARCserve Backup Multiple Vulnerabilities mailing-list
- 20081011 CA BrightStor ARCServe BackUp Message Engine Remote Command Injection Vulnerability mailing-list
- 31684 vdb-entry
- 1021032 vdb-entry
- ADV-2008-2777 vdb-entry
- ca-arcservebackup-message-command-execution(45774) vdb-entry
- support.ca.com patch vendor-advisory