exploit the possibilities

CA ARCserver Backup Message Engine Denial Of Service

CA ARCserver Backup Message Engine Denial Of Service
Posted Jun 16, 2009
Authored by Ken Williams | Site www3.ca.com

CA ARCserve Backup contains multiple vulnerabilities in the message engine that can allow a remote attacker to cause a denial of service. CA has issued an update to address the vulnerabilities. The vulnerabilities occur due to insufficient verification of data sent to the message engine. An attacker can make requests that can cause the message engine to crash.

tags | advisory, remote, denial of service, vulnerability
advisories | CVE-2009-1761
MD5 | 6fa94544d3fed11c9f97fd2e854a1646

CA ARCserver Backup Message Engine Denial Of Service

Change Mirror Download

Title: CA20090615-01: CA ARCserve Backup Message Engine Denial of
Service Vulnerabilities


CA Advisory Reference: CA20090615-01


CA Advisory Date: 2009-06-15


Reported By: iViZ Security Research Team


Impact: A remote attacker can cause a denial of service.


Summary: CA ARCserve Backup contains multiple vulnerabilities in
the message engine that can allow a remote attacker to cause a
denial of service. CA has issued an update to address the
vulnerabilities. The vulnerabilities, CVE-2009-1761, occur due to
insufficient verification of data sent to the message engine. An
attacker can make requests that can cause the message engine to
crash.


Mitigating Factors: None


Severity: CA has given these vulnerabilities a Medium risk rating.


Affected Products:
CA ARCserve Backup r12.0 Windows
CA ARCserve Backup r12.0 SP 1 Windows


Non-Affected Products:
CA ARCserve Backup r11.5 SP 4 Windows
CA ARCserve Backup r12.0 SP 2 Windows
CA ARCserve Backup r12.5


Affected Platforms:
Windows


Status and Recommendation:
CA has issued the following patches to address the vulnerabilities.

CA ARCserve Backup r12.0, r12.0 SP1 Windows:
Install Service Pack 2 RO08383.


How to determine if the installation is affected:

CA ARCserve Backup r12.0, r12.0 SP1 Windows:
1. Run the ARCserve Patch Management utility. From the Windows
Start menu, the program can be found under
Programs->CA->ARCserve Patch Management->Patch Status.
2. The main patch status screen will indicate if the patch in
the below table is applied. If the patch is not applied,
then the installation is vulnerable.

Product Patch

CA ARCserve Backup r12.0, r12.0 SP1 Windows RO08383


For more information on the ARCserve Patch Management utility,
read document TEC446265.


Workaround:
None


References (URLs may wrap):
CA Support:
https://support.ca.com/
CA20090615-01: Security Notice for CA ARCserve Backup Message
Engine
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=2095
02
Solution Document Reference APARs:
RO08383, TEC446265
CA Security Response Blog posting:
CA20090615-01: CA ARCserve Backup Message Engine Denial of Service
Vulnerabilities
community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15.aspx
Reported By:
iViZ Security Research Team
http://www.ivizsecurity.com/security-advisory-iviz-sr-09003.html
http://www.ivizsecurity.com/security-advisory-iviz-sr-09004.html
CVE References:
CVE-2009-1761
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1761
OSVDB References: Pending
http://osvdb.org/


Changelog for this advisory:
v1.0 - Initial Release


Customers who require additional information should contact CA
Technical Support at https://support.ca.com.

For technical questions or comments related to this advisory,
please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your
findings to the CA Product Vulnerability Response Team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1777
82


Regards,
Ken Williams, Director ; 0xE2941985
CA Product Vulnerability Response Team


CA, 1 CA Plaza, Islandia, NY 11749

Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2009 CA. All rights reserved.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    11 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    2 Files
  • 19
    Aug 19th
    18 Files
  • 20
    Aug 20th
    19 Files
  • 21
    Aug 21st
    17 Files
  • 22
    Aug 22nd
    9 Files
  • 23
    Aug 23rd
    3 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close