CVE-2008-2242

Related Files

Zero Day Initiative Advisory 08-026

Posted May 20, 2008

Authored by Damian Put, Tipping Point | Site zerodayinitiative.com

A vulnerability allows attackers to execute arbitrary code on vulnerable installations of CA BrightStor ARCserve Backup for Linux. User interaction is not required to exploit this vulnerability. The specific flaw exists due to improper bounds checking in the xdr_rwsstring() library function. By sending a long parameter into a daemon using this function to process strings, a stack based buffer overflow occurs, leading to execution of arbitrary code.

tags | advisory, overflow, arbitrary

systems | linux

advisories | CVE-2008-2242

SHA-256 | 5beac44d9fa93dd531a5772fb664510c95b8fb10a85ab02246b9e9235be2a914

Download | Favorite | View

CA-caloggerdxdr.txt

Posted May 20, 2008

Authored by Ken Williams | Site www3.ca.com

CA ARCserve Backup contains multiple vulnerabilities that can allow a remote attacker to cause a denial of service or execute arbitrary code. CA has issued patches to address the vulnerabilities. The first vulnerability, CVE-2008-2241, is due to insufficient path verification by the logging service, caloggerd. An attacker can append data to arbitrary files, which can lead to system compromise. The second vulnerability, CVE-2008-2242, is due to insufficient bounds checking by multiple xdr functions. An attacker can cause an overflow and execute arbitrary code.

tags | advisory, remote, denial of service, overflow, arbitrary, vulnerability

advisories | CVE-2008-2241, CVE-2008-2242

SHA-256 | 4e72f135e85d378c8daae3e615f25746727f11c302917fbfcb8e7d99f84d149b

Download | Favorite | View