Shirkdog

**Name of the Vulnerable Software and Affected Versions** CA BrightStor Backup version 11.5.2.0 SP2 **Description** The issue allows remote attackers to cause a denial of service, resulting in a NULL dereference and application crash, via a crafted RPC packet. This is related to the caloggerd.exe and mediasvr.exe components, specifically the camt70.dll, catirpc.dll, and rwxdr.dll libraries. **Recommendations** For CA BrightStor Backup version 11.5.2.0 SP2, consider restricting access to the RPC service until a patch is available to prevent potential denial of service attacks. As a temporary workaround, disabling the vulnerable components, such as caloggerd.exe and mediasvr.exe, may help minimize the risk of exploitation. However, this should be done with caution, as it may impact the functionality of the backup system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CA BrightStor ARCserve Backup versions 11.5 SP2 and earlier Description: The issue allows remote attackers to cause a denial of service, resulting in a service crash, by sending a crafted TADDR2UADDR that triggers a null pointer dereference in catirpc.dll. This could be related to null credentials or verifier fields. Recommendations: For CA BrightStor ARCserve Backup versions 11.5 SP2 and earlier, consider restricting access to the RPC Server service until a patch is available. As a temporary workaround, disabling the catirpc.exe service may prevent the denial of service. However, this may have implications for the functionality of the backup system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Verisign Payflow Link (affected versions not specified) Description: The issue concerns a problem with verifying data in the hidden `AMOUNT` field when the Accepted URL fields are empty. This allows remote attackers to modify the price of items they purchase. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.