CA ARCserve Backup消息引擎拒绝服务漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1182518 漏洞类型 输入验证
发布时间 2009-06-16 更新时间 2009-06-16
CVE编号 CVE-2009-1761 CNNVD-ID CNNVD-200906-281
漏洞平台 N/A CVSS评分 5.0
|漏洞来源
https://www.securityfocus.com/bid/35396
https://cxsecurity.com/issue/WLB-2009060043
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200906-281
|漏洞详情
CA的ARCserveBackup可为各种平台的服务器提供备份和恢复保护功能。ARCserveBackup消息引擎中的多个模块存在拒绝服务的情况。如果远程攻击者向监听的6503/TCP端口发送恶意的RPC报文的话,就可以触发上述漏洞。
|漏洞EXP
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Title: CA20090615-01: CA ARCserve Backup Message Engine Denial of 
Service Vulnerabilities


CA Advisory Reference: CA20090615-01


CA Advisory Date: 2009-06-15


Reported By: iViZ Security Research Team


Impact: A remote attacker can cause a denial of service.


Summary: CA ARCserve Backup contains multiple vulnerabilities in 
the message engine that can allow a remote attacker to cause a 
denial of service. CA has issued an update to address the 
vulnerabilities. The vulnerabilities, CVE-2009-1761, occur due to 
insufficient verification of data sent to the message engine. An 
attacker can make requests that can cause the message engine to 
crash.


Mitigating Factors: None


Severity: CA has given these vulnerabilities a Medium risk rating.


Affected Products:
CA ARCserve Backup r12.0 Windows
CA ARCserve Backup r12.0 SP 1 Windows


Non-Affected Products:
CA ARCserve Backup r11.5 SP 4 Windows
CA ARCserve Backup r12.0 SP 2 Windows
CA ARCserve Backup r12.5


Affected Platforms:
Windows


Status and Recommendation:
CA has issued the following patches to address the vulnerabilities.

CA ARCserve Backup r12.0, r12.0 SP1 Windows:
Install Service Pack 2 RO08383.


How to determine if the installation is affected:

CA ARCserve Backup r12.0, r12.0 SP1 Windows:
   1. Run the ARCserve Patch Management utility. From the Windows 
      Start menu, the program can be found under 
      Programs->CA->ARCserve Patch Management->Patch Status.
   2. The main patch status screen will indicate if the patch in 
      the below table is applied. If the patch is not applied, 
      then the installation is vulnerable.

Product                                          Patch

CA ARCserve Backup r12.0, r12.0 SP1 Windows      RO08383


For more information on the ARCserve Patch Management utility, 
read document TEC446265.


Workaround: 
None


References (URLs may wrap):
CA Support:
https://support.ca.com/
CA20090615-01: Security Notice for CA ARCserve Backup Message 
   Engine
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=2095
02
Solution Document Reference APARs:
RO08383, TEC446265
CA Security Response Blog posting:
CA20090615-01: CA ARCserve Backup Message Engine Denial of Service 
   Vulnerabilities
community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15.aspx
Reported By: 
iViZ Security Research Team
http://www.ivizsecurity.com/security-advisory-iviz-sr-09003.html
http://www.ivizsecurity.com/security-advisory-iviz-sr-09004.html
CVE References:
CVE-2009-1761
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1761
OSVDB References: Pending
http://osvdb.org/


Changelog for this advisory:
v1.0 - Initial Release


Customers who require additional information should contact CA
Technical Support at https://support.ca.com.

For technical questions or comments related to this advisory, 
please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your 
findings to the CA Product Vulnerability Response Team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782


Regards,
Ken Williams, Director ; 0xE2941985
CA Product Vulnerability Response Team


CA, 1 CA Plaza, Islandia, NY 11749
        
Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2009 CA. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.10.0 (Build 500)
Charset: utf-8

wj8DBQFKN4KLeSWR3+KUGYURAme/AJwOT497kNgqXAGFzXuwRVfxUSYJ5QCfWQ7G
e2A9SJJB53CpJi3mE37Cw3g=
=KMJo
-----END PGP SIGNATURE-----

|受影响的产品
Computer Associates BrightStor ARCServe Backup r12.0 Windows SP1 Computer Associates BrightStor ARCServe Backup r12.0 Windows
|参考资料

来源:support.ca.com
链接:http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=209502
来源:community.ca.com
链接:http://community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15/ca20090615-01-ca-arcserve-backup-message-engine-denial-of-service-vulnerabilities.aspx
来源:XF
名称:ca-arcserve-ascore-dos(51169)
链接:http://xforce.iss.net/xforce/xfdb/51169
来源:VUPEN
名称:ADV-2009-1608
链接:http://www.vupen.com/english/advisories/2009/1608
来源:SECTRACK
名称:1022405
链接:http://www.securitytracker.com/id?1022405
来源:BID
名称:35396
链接:http://www.securityfocus.com/bid/35396
来源:BUGTRAQ
名称:20090616CA20090615-01:CAARCserveBackupMessageEngineDenialofServiceVulnerabilities(Updated)
链接:http://www.securityfocus.com/archive/1/archive/1/504349/100/0/threaded
来源:BUGTRAQ
名称:20090616CA20090615-01:CAARCserveBackupMessageEngineDenialofServiceVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/504348/100/0/threaded
来源:MISC
链接:http://www.ivizsecurity.com/security-advisory-iviz-sr-09004.html
来源:MISC
链接