[Full-disclosure] Assurent VR - CA ARCserve Backup DB Engine Denial of Service

CA ARCserve Backup DB Engine Denial of Service Assurent ID: FSC20081009-12 1. Affected Software CA ARCserve Backup 11.1 Windows CA ARCserve Backup 11.5 Windows CA ARCserve Backup 12.0 Windows Reference: http://www.ca.com/us/data-loss-prevention.aspx 2. Vulnerability Summary A vulnerability has be...

CVE-2008-4397

Directory traversal vulnerability in the RPC interface asdbapi.dll in CA ARCserve Backup formerly BrightStor ARCserve Backup r11.1 through r12.0 allows remote attackers to execute arbitrary commands via a .. dot dot in an RPC call with opnum 0x10A...

CVE-2008-4398

Unspecified vulnerability in the tape engine service in asdbapi.dll in CA ARCserve Backup formerly BrightStor ARCserve Backup r11.1 through r12.0 allows remote attackers to cause a denial of service crash via a crafted request...

CVE-2008-4400

Unspecified vulnerability in asdbapi.dll in CA ARCserve Backup formerly BrightStor ARCserve Backup r11.1 through r12.0 allows remote attackers to cause a denial of service crash of multiple services via crafted authentication credentials, related to "insufficient validation."...

Input validation

Unspecified vulnerability in asdbapi.dll in CA ARCserve Backup formerly BrightStor ARCserve Backup r11.1 through r12.0 allows remote attackers to cause a denial of service crash of multiple services via crafted authentication credentials, related to "insufficient validation."...

Directory traversal

Directory traversal vulnerability in the RPC interface asdbapi.dll in CA ARCserve Backup formerly BrightStor ARCserve Backup r11.1 through r12.0 allows remote attackers to execute arbitrary commands via a .. dot dot in an RPC call with opnum 0x10A...

CVE-2008-4400

CVE-2008-4400 affects CA ARCserve Backup (BrightStor ARCserve Backup) r11.1–r12.0. The vulnerability is in asdbapi.dll and stems from insufficient validation of authentication credentials, allowing remote attackers to cause a denial of service by crashing multiple services. Remediation is availab...

CVE-2008-4398

Unspecified vulnerability in the tape engine service in asdbapi.dll in CA ARCserve Backup formerly BrightStor ARCserve Backup r11.1 through r12.0 allows remote attackers to cause a denial of service crash via a crafted request...

CVE-2008-4398

CVE-2008-4398 affects CA ARCserve Backup Tape Engine (asdbapi.dll) on Windows r11.1–r12.0. The issue is insufficient input validation in the Tape Engine service, allowing a remote attacker to trigger a denial-of-service (crash) by sending a crafted RPC message. Public advisories from CA identify ...

CVE-2008-4397

CVE-2008-4397 is a directory traversal flaw in the RPC interface (asdbapi.dll) of CA ARCserve Backup (BrightStor ARCserve Backup) versions r11.1–r12.0. An unauthenticated remote attacker can craft RPC calls (opnum 0x10A) to traverse directories and execute arbitrary commands. Multiple connected s...

CVE-2008-4399

CA ARCserve Backup DB Engine vulnerability CVE-2008-4399 affects the asdbapi.dll database engine service in CA ARCserve Backup r11.1–r12.0. The issue stems from insufficient validation of remote RPC requests, allowing remote unauthenticated attackers to cause a denial of service (crash) of the DB...

CVE-2008-4400

Unspecified vulnerability in asdbapi.dll in CA ARCserve Backup formerly BrightStor ARCserve Backup r11.1 through r12.0 allows remote attackers to cause a denial of service crash of multiple services via crafted authentication credentials, related to "insufficient validation."...

CVE-2008-4397

Directory traversal vulnerability in the RPC interface asdbapi.dll in CA ARCserve Backup formerly BrightStor ARCserve Backup r11.1 through r12.0 allows remote attackers to execute arbitrary commands via a .. dot dot in an RPC call with opnum 0x10A...

CA BrightStor ARCServe BackUp Message Engine Remote Command Injection Vulnerability

CA BrightStor ARCServe BackUp Message Engine Remote Command Injection Vulnerability by cocoruderfrankruderathotmail.com http://ruder.cdut.net Summary: CA BrightStor ARCServe BackUp is an overall data backup solution. The RPC interface of CA BrightStor ARCServe BackUp does not handle user's input...

CA BrightStor ARCserve Backup RPC Interface (asdbapi.dll) Traversal Arbitrary Command Execution

This host is running BrightStor ARCServe for Windows. The remote version of this software is affected by an arbitrary command execution vulnerability. By sending a specially crafted packet to the RPC server on TCP port 6504, an unauthenticated, remote attacker may be able to execute code on the...

CA ARCserve Backup Multiple Vulnerabilities

Title: CA ARCserve Backup Multiple Vulnerabilities CA Advisory Date: 2008-10-09 Reported By: Haifei Li of Fortinet's FortiGuard Global Security Research Team Vulnerability Research Team of Assurent Secure Technologies, a TELUS Company Greg Linares of eEye Digital Security Impact: A remote attacke...

cabrightstor-exec.txt

CA BrightStor ARCServe BackUp Message Engine Remote Command Injection Vulnerability by cocoruderfrankruderathotmail.com http://ruder.cdut.net Summary: CA BrightStor ARCServe BackUp is an overall data backup solution. The RPC interface of CA BrightStor ARCServe BackUp does not handle user's input...

CA ARCserve Backup LGServer handshake buffer overflow

Added: 08/11/2008 CVE: CVE-2008-3175 BID: 30472 OSVDB: 47545 Background BrightStor ARCserve Backup for Laptops and Desktops is an automated backup solution optimized for low-bandwidth, intermittent network connections. Problem A buffer overflow vulnerability in the LGServer.exe server process...

CA ARCserve Backup LGServer handshake buffer overflow

Added: 08/11/2008 CVE: CVE-2008-3175 BID: 30472 OSVDB: 47545 Background BrightStor ARCserve Backup for Laptops and Desktops is an automated backup solution optimized for low-bandwidth, intermittent network connections. Problem A buffer overflow vulnerability in the LGServer.exe server process...

CA ARCserve Backup LGServer handshake buffer overflow

Added: 08/11/2008 CVE: CVE-2008-3175 BID: 30472 OSVDB: 47545 Background BrightStor ARCserve Backup for Laptops and Desktops is an automated backup solution optimized for low-bandwidth, intermittent network connections. Problem A buffer overflow vulnerability in the LGServer.exe server process...