On June 15th, 2009, CA published a security notice to address multiple vulnerabilities in CA ARCserve Backup.
Title: CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities
CA Advisory Reference: CA20090615-01
CA Advisory Date: 2009-06-15
Reported By: iViZ Security Research Team
Impact: A remote attacker can cause a denial of service.
Summary: CA ARCserve Backup contains multiple vulnerabilities in the message engine that can allow a remote attacker to cause a denial of service. CA has issued an update to address the vulnerabilities. The vulnerabilities, CVE-2009-1761, occur due to insufficient verification of data sent to the message engine. An attacker can make requests that can cause the message engine to crash.
Mitigating Factors: None
Severity: CA has given these vulnerabilities a Medium risk rating.
Affected Products:
CA ARCserve Backup r12.0 Windows
CA ARCserve Backup r12.0 SP 1 Windows
Non-Affected Products:
CA ARCserve Backup r11.5 SP 4 Windows
CA ARCserve Backup r12.0 SP 2 Windows
CA ARCserve Backup r12.5
Affected Platforms:
Windows
Status and Recommendation:
CA has issued the following patches to address the vulnerabilities.
CA ARCserve Backup r12.0, r12.0 SP1 Windows:
Install Service Pack 2 RO08383.
How to determine if the installation is affected:
CA ARCserve Backup r12.0, r12.0 SP1 Windows:
1. Run the ARCserve Patch Management utility. From the Windows Start menu, the program can be found under Programs->CA->ARCserve Patch Management->Patch Status.
2. The main patch status screen will indicate if the patch in the below table is applied. If the patch is not applied, then the installation is vulnerable.
| Product | Patch |
| CA ARCserve Backup r12.0, r12.0 SP1 Windows | RO08383 |
For more information on the ARCserve Patch Management utility, read document TEC446265.
Workaround: None
References (URLs may wrap):
CA Support:
https://support.ca.com/
CA20090615-01: Security Notice for CA ARCserve Backup Message Engine
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=209502
Solution Document Reference APARs:
RO08383, TEC446265
CA Security Response Blog posting:
CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15.aspx
Reported By:
iViZ Security Research Team
http://www.ivizsecurity.com/security-advisory-iviz-sr-09003.html
http://www.ivizsecurity.com/security-advisory-iviz-sr-09004.html
CVE References:
CVE-2009-1761
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1761
OSVDB References: Pending
http://osvdb.org/
Changelog for this advisory:
v1.0 - Initial Release
Customers who require additional information should contact CA Technical Support at https://support.ca.com.
For technical questions or comments related to this advisory, please send email to vuln AT ca DOT com.
If you discover a vulnerability in CA products, please report your findings to the CA Product Vulnerability Response Team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782
The opinions and statements on this site are my own and do not necessarily reflect the opinions or policies of CA.