PT-2007-2260 · Ca · Ca Brightstor Arcserve Backup

Shirkdog · Published 2007-02-07 · Updated 2021-04-07 · CVE-2007-0816

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: CA BrightStor ARCserve Backup versions 11.5 SP2 and earlier

Description: The issue allows remote attackers to cause a denial of service, resulting in a service crash, by sending a crafted TADDR2UADDR that triggers a null pointer dereference in catirpc.dll. This could be related to null credentials or verifier fields.

Recommendations: For CA BrightStor ARCserve Backup versions 11.5 SP2 and earlier, consider restricting access to the RPC Server service until a patch is available. As a temporary workaround, disabling the catirpc.exe service may prevent the denial of service. However, this may have implications for the functionality of the backup system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-0816

Affected Products

Ca Brightstor Arcserve Backup

References · 14

• 🔥 https://exploit-db.com/exploits/3248 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0816 · Security Note
• http://frsirt.com/english/advisories/2007/0461 · Note
• http://xforce.iss.net/xforce/xfdb/32137 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32137 · Note
• http://osvdb.org/32989 · Note
• http://securityfocus.com/bid/22365 · Note
• http://secunia.com/advisories/24009 · Note
• http://secunia.com/advisories/24512 · Note
• http://vupen.com/english/advisories/2007/0461 · Note
• http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=35058 · Note
• http://supportconnectw.ca.com/public/storage/infodocs/babtapeng-securitynotice.asp · Note
• http://milw0rm.com/exploits/3248 · Note
• http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?cid=101317 · Note