what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

CAID-disc-dos.txt

CAID-disc-dos.txt
Posted Jun 18, 2008
Authored by Ken Williams | Site www3.ca.com

CA ARCserve Backup contains a vulnerability in the Discovery service (casdscsvc) that can allow a remote attacker to cause a denial of service condition. CA has issued patches to address the vulnerability. The vulnerability occurs due to insufficient verification of client data. An attacker can make a request that can crash the service.

tags | advisory, remote, denial of service
advisories | CVE-2008-1979
SHA-256 | 0741ffe1de4d95ff387305e81ed6300a04528dc9d2dc44058f58fe0edd600007

CAID-disc-dos.txt

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Title: CA ARCserve Backup Discovery Service Denial of Service
Vulnerability


CA Advisory Date: 2008-06-17


Reported By: Luigi Auriemma


Impact: A remote attacker can cause a denial of service.


Summary: CA ARCserve Backup contains a vulnerability in the
Discovery service (casdscsvc) that can allow a remote attacker to
cause a denial of service condition. CA has issued patches to
address the vulnerability. The vulnerability, CVE-2008-1979,
occurs due to insufficient verification of client data. An
attacker can make a request that can crash the service.


Mitigating Factors: None


Severity: CA has given this vulnerability a Medium risk rating.


Affected Products:
CA ARCserve Backup r12.0 Windows
CA ARCserve Backup r11.5 Windows SP3 and prior*
CA ARCserve Backup r11.1 Windows*
CA ARCserve Backup r11.1 Netware*
CA Server Protection Suite r2
CA Business Protection Suite r2
CA Business Protection Suite for Microsoft Small Business Server
Standard Edition r2
CA Business Protection Suite for Microsoft Small Business Server
Premium Edition r2

*Formerly known as BrightStor ARCserve Backup


Non-affected Products:
CA ARCserve Backup r11.5 Windows SP4


Affected Platforms:
Windows and Netware


Status and Recommendation:
CA has issued the following patches to address the
vulnerabilities.
CA ARCserve Backup r12.0 Windows: QO99574
CA ARCserve Backup r11.5 Windows: QO99575
For CA ARCserve Backup r11.5 Windows, the issue can also be
addressed by applying 11.5 SP4: QO99129
CA ARCserve Backup r11.1 Windows: QO99576
CA ARCserve Backup r11.1 Netware: QO99579
CA Protection Suites r2: QO99575


How to determine if you are affected:

CA ARCserve Backup r12.0 Windows:

1. Run the ARCserve Patch Management utility. From the Windows
Start menu, it can be found under Programs->CA->ARCserve Patch
Management->Patch Status.
2. The main patch status screen will indicate if patch “QO99574”
is currently applied. If the patch is not applied, the
installation is vulnerable.

For more information on the ARCserve Patch Management utility,
read document TEC446265.

Alternatively, use the file information below to determine if the
product installation is vulnerable.

CA ARCserve Backup r12.0 Windows,
CA ARCserve Backup r11.5 Windows,
CA ARCserve Backup r11.1 Windows,
CA ARCserve Backup r11.1 Netware,
CA Protection Suites r2*:

1. Using Windows Explorer, locate the file “asbrdcst.dll”. By
default, the file is located in the
“C:\Program Files\CA\SharedComponents\ARCserve Backup\CADS”
directory on 32 bit systems and “C:\Program Files (x86)\CA\
SharedComponents\ARCserve Backup\CADS” on 64 bit systems.
2. Right click on the file and select Properties.
3. Select the General tab.
4. If the file timestamp is earlier than indicated in the below
table, the installation is vulnerable.

* For Protection Suites r2, use the file timestamp for CA ARCserve
Backup r11.5 English

Product Ver Product Lang File Name File Sz Timestamp
(bytes)
12.0 Windows English asbrdcst.dll 324872 05/01/2008 12:11
12.0 Windows Spanish asbrdcst.dll 324872 05/01/2008 12:11
12.0 Windows Port-Braz asbrdcst.dll 320776 05/01/2008 12:11
12.0 Windows Japanese asbrdcst.dll 320776 05/01/2008 12:11
12.0 Windows Italian asbrdcst.dll 324872 05/01/2008 12:11
12.0 Windows German asbrdcst.dll 324872 05/01/2008 12:11
12.0 Windows French asbrdcst.dll 324872 05/01/2008 12:11
12.0 Windows Trad Chinese asbrdcst.dll 316680 05/01/2008 12:11
12.0 Windows Simp Chinese asbrdcst.dll 316680 05/01/2008 12:11
11.5 Windows English asbrdcst.dll 212992 04/22/2008 10:15:02
11.5 Windows Japanese asbrdcst.dll 208896 04/22/2008 14:28:52
11.5 Windows Simp Chinese asbrdcst.dll 204800 04/22/2008 14:30:54
11.5 Windows Trad Chinese asbrdcst.dll 204800 04/22/2008 14:33:28
11.5 Windows Italian asbrdcst.dll 212992 04/22/2008 14:31:46
11.5 Windows Port-Braz asbrdcst.dll 212992 04/22/2008 14:53:54
11.5 Windows German asbrdcst.dll 212992 04/22/2008 14:27:48
11.5 Windows French asbrdcst.dll 212992 04/22/2008 14:26:54
11.5 Windows Spanish asbrdcst.dll 212992 04/22/2008 14:32:38
11.1 Windows English asbrdcst.dll 204800 04/24/2008 11:21:26
11.1 Windows Japanese asbrdcst.dll 200704 04/24/2008 11:25:48
11.1 Windows Simp Chinese asbrdcst.dll 196608 04/24/2008 11:27:44
11.1 Windows Trad Chinese asbrdcst.dll 196608 04/24/2008 11:30:32
11.1 Windows Italian asbrdcst.dll 204800 04/24/2008 11:28:38
11.1 Windows Port-Braz asbrdcst.dll 204800 04/24/2008 11:38:52
11.1 Windows German asbrdcst.dll 204800 04/24/2008 11:24:38
11.1 Windows French asbrdcst.dll 204800 04/24/2008 11:23:38
11.1 Windows Spanish asbrdcst.dll 204800 04/24/2008 11:29:34
11.1 Windows Dutch asbrdcst.dll 204800 04/24/2008 11:33:24
11.1 Windows Polish asbrdcst.dll 204800 04/24/2008 11:38:02
11.1 Windows Russian asbrdcst.dll 204800 04/24/2008 11:39:44
11.1 Windows Turkish asbrdcst.dll 204800 04/24/2008 11:41:28
11.1 Windows Norwegian asbrdcst.dll 204800 04/24/2008 11:37:12
11.1 Windows Danish asbrdcst.dll 204800 04/24/2008 11:32:28
11.1 Windows Czech asbrdcst.dll 204800 04/24/2008 11:31:28
11.1 Windows Hungarian asbrdcst.dll 204800 04/24/2008 11:36:22
11.1 Windows Swedish asbrdcst.dll 204800 04/24/2008 11:40:38
11.1 Windows Finnish asbrdcst.dll 204800 04/24/2008 11:34:40
11.1 Windows Greek asbrdcst.dll 204800 04/24/2008 11:35:32
11.1 Netware English asbrdcst.dll 204800 04/24/2008 11:21:26


Workaround: As a temporary workaround, stop and disable the CA
ARCserve Discovery service. With the service disabled, deploying
agents using Auto-discovery will not work.


References (URLs may wrap):
CA Support:
http://support.ca.com/
Security Notice for CA ARCserve Discovery Service
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=178937
Solution Document Reference APARs:
QO99574, QO99575, QO99129, QO99576, QO99579
CA Security Response Blog posting:
CA ARCserve Backup Discovery Service Denial of Service Vulnerability
http://community.ca.com/blogs/casecurityresponseblog/archive/2008/06/18.asp
x
Reported By:
Luigi Auriemma
http://aluigi.altervista.org/adv/carcbackazz-adv.txt
CVE References:
CVE-2008-1979 - casdscsvc denial of service
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1979
OSVDB References: Pending
http://osvdb.org/


Changelog for this advisory:
v1.0 - Initial Release


Customers who require additional information should contact CA
Technical Support at http://support.ca.com.

For technical questions or comments related to this advisory,
please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your
findings to our product security response team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782


Regards,
Ken Williams ; 0xE2941985
Director, CA Vulnerability Research


CA, 1 CA Plaza, Islandia, NY 11749

Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2008 CA. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.5.3 (Build 5003)

wj8DBQFIWR6beSWR3+KUGYURAieJAJ9a+VTiwKJ78Y80eD86o8AeTm/d4ACeL2+W
hl/jlkzEtAHwCF9eUt1TjMo=
=RXzI
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

February 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    16 Files
  • 2
    Feb 2nd
    19 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    2 Files
  • 7
    Feb 7th
    10 Files
  • 8
    Feb 8th
    25 Files
  • 9
    Feb 9th
    37 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    20 Files
  • 14
    Feb 14th
    25 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    6 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    35 Files
  • 20
    Feb 20th
    25 Files
  • 21
    Feb 21st
    18 Files
  • 22
    Feb 22nd
    15 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    10 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    37 Files
  • 27
    Feb 27th
    34 Files
  • 28
    Feb 28th
    27 Files
  • 29
    Feb 29th
    8 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close