[NT] CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow
Vulnerabilities
------------------------------------------------------------------------

SUMMARY

<http://www3.ca.com/solutions/Product.aspx?ID=263> ARCServe Backup for
"Laptops and Desktops is a version of ARCServe Backup targeted at small to
medium sized businesses, with many mobile/remote users. It provides client
agents that detect network connectivity and commit backup data when it is
found". Remote exploitation of multiple buffer overflow vulnerabilities in
Computer Associates Inc.'s ARCServe Backup for Laptops and Desktops allows
attackers to execute arbitrary code with SYSTEM privileges.

DETAILS

Vulnerable Systems:
* ARCServe Backup for Laptops and Desktops version 11.1 (Build 900)

The LGServer contains multiple vulnerable functions that handle network
requests, several of which contain more than one vulnerability. All
together there are nearly 60 buffer overflows in the LGServer.

The majority of these are the result of copying remotely supplied strings
into fixed-size buffers without validating that enough space is available.
A list of vulnerable commands follows.

rxsAddNewUser, rxsSetUserInfo, rxsRenameUser, rxsSetMessageLogSettings,
rxsExportData, rxsSetServerOptions, rxsRenameFile, rxsACIManageSend,
rxsExportUser, rxsImportUser, rxsMoveUserData, rxsUseLicenseIni,
rxsLicGetSiteId, rxsGetLogFileNames, rxsGetBackupLog, rxsBackupComplete,
rxsSetDataProtectionSecurityData, rxsSetDefaultConfigName,
rxsGetMessageLogSettings, rxsHWDiskGetTotal, rxsHWDiskGetFree,
rxsGetSubDirs, rxsGetServerDBPathName, rxsSetServerOptions, rxsDeleteFile,
rxsACIManageSend, rxcReadBackupSetList, rxcWriteConfigInfo,
rxcSetAssetManagement, rxcWriteFileListForRestore, rxcReadSaveSetProfile,
rxcInitSaveSetProfile, rxcAddSaveSetNextAppList,
rxcAddSaveSetNextFilesPathList, rxcAddNextBackupSetIncWildCard,
rxcGetRevisions, rxrAddMovedUser, rxrSetClientVersion

By sending requests for the above functions with specially crafted
parameters, it is possible to cause a buffer overflow. Although most
involve stack based buffers, several involve heap based buffers.

Additionally, a stack based buffer overflow vulnerability exists in the
GetUserInfo() function. This function is a utility function that is
used by many of the request handling functions. It is possible to trigger
this vulnerability by passing a long user name parameter to this function.

Another stack based buffer overflow exists within the handler for the
rxrLogin request. As its name suggests, this command logs in the user
after reading in the name and password. This handler contains several
unsafe calls to wsprintf(). By providing a long user name it is possible
to overflow a fixed size stack based buffer.

Analysis:
Exploitation allows an attacker to execute arbitrary code with SYSTEM
privileges.

In order to exploit these vulnerabilities, an attacker must be able to
establish a TCP session with the LGServer on port 1900. Unsuccessful
exploitation attempts will crash the server, which will not restart
automatically.

All of these vulnerabilities, with the exception of those in the rxrLogin
command, should only be able to be triggered by an authenticated server
administrator. However, due to the authentication bypass vulnerability
described in a previous iDefense advisory any unauthenticated user can
trigger them.

Vendor response:
Computer Associates has addressed these vulnerabilities with an update.
For more information consult CA's security notice at the following URL.
<http://supportconnectw.ca.com/public/sams/lifeguard/infodocs/caarcservebld-securitynotice.asp> http://supportconnectw.ca.com/public/sams/lifeguard/infodocs/caarcservebld-securitynotice.asp

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5003>
CVE-2007-5003 and
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3216>
CVE-2007-3216

Disclosure Timeline:
03/21/2007 - Initial vendor notification
03/21/2007 - Initial vendor response
09/20/2007 - Public disclosure

ADDITIONAL INFORMATION

The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=599>

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=599

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.