[Full-disclosure] CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Title: CA20090615-01: CA ARCserve Backup Message Engine Denial of
Service Vulnerabilities

CA Advisory Reference: CA20090615-01

CA Advisory Date: 2009-06-15

Reported By: iViZ Security Research Team

Impact: A remote attacker can cause a denial of service.

Summary: CA ARCserve Backup contains multiple vulnerabilities in
the message engine that can allow a remote attacker to cause a
denial of service. CA has issued an update to address the
vulnerabilities. The vulnerabilities, CVE-2009-1761, occur due to
insufficient verification of data sent to the message engine. An
attacker can make requests that can cause the message engine to
crash.

Mitigating Factors: None

Severity: CA has given these vulnerabilities a Medium risk rating.

Affected Products:
CA ARCserve Backup r12.0 Windows
CA ARCserve Backup r12.0 SP 1 Windows

Non-Affected Products:
CA ARCserve Backup r11.5 SP 4 Windows
CA ARCserve Backup r12.0 SP 2 Windows
CA ARCserve Backup r12.5

Affected Platforms:
Windows

Status and Recommendation:
CA has issued the following patches to address the vulnerabilities.

CA ARCserve Backup r12.0, r12.0 SP1 Windows:
Install Service Pack 2 RO08383.

How to determine if the installation is affected:

CA ARCserve Backup r12.0, r12.0 SP1 Windows:

1. Run the ARCserve Patch Management utility. From the Windows
   Start menu, the program can be found under
   Programs->CA->ARCserve Patch Management->Patch Status.
2. The main patch status screen will indicate if the patch in
   the below table is applied. If the patch is not applied,
   then the installation is vulnerable.

Product Patch

CA ARCserve Backup r12.0, r12.0 SP1 Windows RO08383

For more information on the ARCserve Patch Management utility,
read document TEC446265.

Workaround:
As a workaround solution, disable the Apache HTTP Server with the
"stopgui" command. To re-enable the server, run "startgui".

Stopping the Apache HTTP Server will prevent the ARCserve user
from performing GUI operations. Most of the operations provided by
the GUI can be accomplished via the command line.

Alternatively, restrict remote network access to reduce exposure.

References (URLs may wrap):
CA Support:
https://support.ca.com/
CA20090615-01: Security Notice for CA ARCserve Backup Message
Engine
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=2095
02
Solution Document Reference APARs:
RO08383, TEC446265
CA Security Response Blog posting:
CA20090615-01: CA ARCserve Backup Message Engine Denial of Service
Vulnerabilities
community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15.aspx
Reported By:
iViZ Security Research Team
http://www.ivizsecurity.com/security-advisory-iviz-sr-09003.html
http://www.ivizsecurity.com/security-advisory-iviz-sr-09004.html
CVE References:
CVE-2009-1761
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1761
OSVDB References: Pending
http://osvdb.org/

Changelog for this advisory:
v1.0 - Initial Release

Customers who require additional information should contact CA
Technical Support at https://support.ca.com.

For technical questions or comments related to this advisory,
please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your
findings to the CA Product Vulnerability Response Team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1777
82

Regards,
Ken Williams, Director ; 0xE2941985
CA Product Vulnerability Response Team

CA, 1 CA Plaza, Islandia, NY 11749

Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2009 CA. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.10.0 (Build 500)
Charset: utf-8

wj8DBQFKN4BReSWR3+KUGYURAnntAJ0dUor2RDKLtPoK0WDwD5PQJfOOAACfbIc6
XKLgaLtL5OJrrHDc1SoHoy4=
=uoXR
-----END PGP SIGNATURE-----

---

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/