PT-2007-6111 · Ca · Ca Brightstor Arcserve Backup For Laptops/Desktops

Published 2007-10-01 · Updated 2021-04-08 · CVE-2007-5005

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CA BrightStor ARCserve Backup for Laptops and Desktops versions r11.0 through r11.5

Description The issue allows remote attackers to upload and overwrite arbitrary files. This is achieved by using a .. (dot dot backslash) sequence in the destination filename argument to sub-function 8 in the rxrReceiveFileFromServer command.

Recommendations For versions r11.0 through r11.5, consider restricting access to the rxrReceiveFileFromServer command until a fix is available, and avoid using the .. sequence in the destination filename argument to prevent arbitrary file overwrites. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-5005

Affected Products

Ca Brightstor Arcserve Backup For Laptops/Desktops

References · 9

• http://ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35676 · Patch
• http://ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=156006 · Patch
• http://secunia.com/advisories/25606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5005 · Security Note
• http://supportconnectw.ca.com/public/sams/lifeguard/infodocs/caarcservebld-securitynotice.asp · Patch
• http://research.eeye.com/html/advisories/published/AD20070920.html · Note
• http://securityfocus.com/archive/1/480252/100/100/threaded · Note
• http://securitytracker.com/id?1018728 · Note
• http://securityfocus.com/bid/24348 · Note