Published:
June 18 2008, 10:16 AM
|
no comments
by
Ken Williams
On June 17th, 2008, CA published a security notice to address a vulnerability in CA ARCserve Backup.
Title: CA ARCserve Backup Discovery Service Denial of Service Vulnerability
CA Advisory Date: 2008-06-17
Reported By: Luigi Auriemma
Impact: A remote attacker can cause a denial of service.
Summary: CA ARCserve Backup contains a vulnerability in the Discovery service (casdscsvc) that can allow a remote attacker to cause a denial of service condition. CA has issued patches to address the vulnerability. The vulnerability, CVE-2008-1979, occurs due to insufficient verification of client data. An attacker can make a request that can crash the service.
Mitigating Factors: None
Severity: CA has given this vulnerability a Medium risk rating.
Affected Products:
CA ARCserve Backup r12.0 Windows
CA ARCserve Backup r11.5 Windows SP3 and prior*
CA ARCserve Backup r11.1 Windows*
CA ARCserve Backup r11.1 Netware*
CA Server Protection Suite r2
CA Business Protection Suite r2
CA Business Protection Suite for Microsoft Small Business Server Standard Edition r2
CA Business Protection Suite for Microsoft Small Business Server Premium Edition r2
*Formerly known as BrightStor ARCserve Backup
Non-affected Products:
CA ARCserve Backup r11.5 Windows SP4
Affected Platforms:
Windows and Netware
Status and Recommendation:
CA has issued the following patches to address the vulnerabilities.
CA ARCserve Backup r12.0 Windows: QO99574
CA ARCserve Backup r11.5 Windows: QO99575
For CA ARCserve Backup r11.5 Windows, the issue can also be addressed by applying 11.5 SP4: QO99129
CA ARCserve Backup r11.1 Windows: QO99576
CA ARCserve Backup r11.1 Netware: QO99579
CA Protection Suites r2: QO99575
How to determine if you are affected:
CA ARCserve Backup r12.0 Windows:
1. Run the ARCserve Patch Management utility. From the Windows Start menu, it can be found under Programs->CA->ARCserve Patch Management->Patch Status.
2. The main patch status screen will indicate if patch “QO99574” is currently applied. If the patch is not applied, the installation is vulnerable.
For more information on the ARCserve Patch Management utility, read document TEC446265.
Alternatively, use the file information below to determine if the product installation is vulnerable.
CA ARCserve Backup r12.0 Windows,
CA ARCserve Backup r11.5 Windows,
CA ARCserve Backup r11.1 Windows,
CA ARCserve Backup r11.1 Netware,
CA Protection Suites r2*:
1. Using Windows Explorer, locate the file “asbrdcst.dll”. By default, the file is located in the “C:\Program Files\CA\SharedComponents\ARCserve Backup\CADS” directory on 32 bit systems and “C:\Program Files (x86)\CA\SharedComponents\ARCserve Backup\CADS” on 64 bit systems.
2. Right click on the file and select Properties.
3. Select the General tab.
4. If the file timestamp is earlier than indicated in the below table, the installation is vulnerable.
* For Protection Suites r2, use the file timestamp for CA ARCserve Backup r11.5 English
| Product Version | Product Language | File Name | File Size (bytes) | Timestamp |
| 12.0 Windows | English | asbrdcst.dll | 324872 | 05/01/2008 12:11 |
| 12.0 Windows | Spanish | asbrdcst.dll | 324872 | 05/01/2008 12:11 |
| 12.0 Windows | Portuguese-Brazilian | asbrdcst.dll | 320776 | 05/01/2008 12:11 |
| 12.0 Windows | Japanese | asbrdcst.dll | 320776 | 05/01/2008 12:11 |
| 12.0 Windows | Italian | asbrdcst.dll | 324872 | 05/01/2008 12:11 |
| 12.0 Windows | German | asbrdcst.dll | 324872 | 05/01/2008 12:11 |
| 12.0 Windows | French | asbrdcst.dll | 324872 | 05/01/2008 12:11 |
| 12.0 Windows | Traditional Chinese | asbrdcst.dll | 316680 | 05/01/2008 12:11 |
| 12.0 Windows | Simplified Chinese | asbrdcst.dll | 316680 | 05/01/2008 12:11 |
| 11.5 Windows | English | asbrdcst.dll | 212992 | 04/22/2008 10:15:02 |
| 11.5 Windows | Japanese | asbrdcst.dll | 208896 | 04/22/2008 14:28:52 |
| 11.5 Windows | Simplified Chinese | asbrdcst.dll | 204800 | 04/22/2008 14:30:54 |
| 11.5 Windows | Traditional Chinese | asbrdcst.dll | 204800 | 04/22/2008 14:33:28 |
| 11.5 Windows | Italian | asbrdcst.dll | 212992 | 04/22/2008 14:31:46 |
| 11.5 Windows | Portuguese-Brazilian | asbrdcst.dll | 212992 | 04/22/2008 14:53:54 |
| 11.5 Windows | German | asbrdcst.dll | 212992 | 04/22/2008 14:27:48 |
| 11.5 Windows | French | asbrdcst.dll | 212992 | 04/22/2008 14:26:54 |
| 11.5 Windows | Spanish | asbrdcst.dll | 212992 | 04/22/2008 14:32:38 |
| 11.1 Windows | English | asbrdcst.dll | 204800 | 04/24/2008 11:21:26 |
| 11.1 Windows | Japanese | asbrdcst.dll | 200704 | 04/24/2008 11:25:48 |
| 11.1 Windows | Simplified Chinese | asbrdcst.dll | 196608 | 04/24/2008 11:27:44 |
| 11.1 Windows | Traditional Chinese | asbrdcst.dll | 196608 | 04/24/2008 11:30:32 |
| 11.1 Windows | Italian | asbrdcst.dll | 204800 | 04/24/2008 11:28:38 |
| 11.1 Windows | Portuguese-Brazilian | asbrdcst.dll | 204800 | 04/24/2008 11:38:52 |
| 11.1 Windows | German | asbrdcst.dll | 204800 | 04/24/2008 11:24:38 |
| 11.1 Windows | French | asbrdcst.dll | 204800 | 04/24/2008 11:23:38 |
| 11.1 Windows | Spanish | asbrdcst.dll | 204800 | 04/24/2008 11:29:34 |
| 11.1 Windows | Dutch | asbrdcst.dll | 204800 | 04/24/2008 11:33:24 |
| 11.1 Windows | Polish | asbrdcst.dll | 204800 | 04/24/2008 11:38:02 |
| 11.1 Windows | Russian | asbrdcst.dll | 204800 | 04/24/2008 11:39:44 |
| 11.1 Windows | Turkish | asbrdcst.dll | 204800 | 04/24/2008 11:41:28 |
| 11.1 Windows | Norwegian | asbrdcst.dll | 204800 | 04/24/2008 11:37:12 |
| 11.1 Windows | Danish | asbrdcst.dll | 204800 | 04/24/2008 11:32:28 |
| 11.1 Windows | Czech | asbrdcst.dll | 204800 | 04/24/2008 11:31:28 |
| 11.1 Windows | Hungarian | asbrdcst.dll | 204800 | 04/24/2008 11:36:22 |
| 11.1 Windows | Swedish | asbrdcst.dll | 204800 | 04/24/2008 11:40:38 |
| 11.1 Windows | Finnish | asbrdcst.dll | 204800 | 04/24/2008 11:34:40 |
| 11.1 Windows | Greek | asbrdcst.dll | 204800 | 04/24/2008 11:35:32 |
| 11.1 Netware | English | asbrdcst.dll | 204800 | 04/24/2008 11:21:26 |
Workaround: As a temporary workaround, stop and disable the CA ARCserve Discovery service. With the service disabled, deploying agents using Auto-discovery will not work.
References (URLs may wrap):
CA Support:
http://support.ca.com/Security Notice for CA ARCserve Discovery Service
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=178937Solution Document Reference APARs:
QO99574, QO99575, QO99129, QO99576, QO99579
CA Security Response Blog posting:
CA ARCserve Backup Discovery Service Denial of Service Vulnerability
http://community.ca.com/blogs/casecurityresponseblog/archive/2008/06/18.aspxReported By:
Luigi Auriemma
http://aluigi.altervista.org/adv/carcbackazz-adv.txtCVE References:
CVE-2008-1979 - casdscsvc denial of service
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1979OSVDB References: Pending
http://osvdb.org/Changelog for this advisory:
v1.0 - Initial Release
Customers who require additional information should contact CA Technical Support at
http://support.ca.com.
For technical questions or comments related to this advisory, please send email to vuln AT ca DOT com.
If you discover a vulnerability in CA products, please report your findings to our product security response team.
URL:
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782
By: Ken Williams
Ken Williams is a Director with the CA Vulnerability Research Team. As a veteran vulnerability researcher, Ken has worked as the Director of the CA Vulnerability Research Team and eVM Research Team, Director of Vulnerability Research at eSecurityOnline, Manager of the Vulnerability Research Team at Ernst...
Read More..