CA BrightStor ARCserve Backup Mediasvr.exe and caloggerd.exe Vulnerabilities

2007-05-24 / 2007-05-25
Risk: Medium
Local: Yes
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 7.8/10
Impact Subscore: 6.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Complete

Title: CA BrightStor ARCserve Backup Mediasvr.exe and caloggerd.exe Vulnerabilities Notice Date: 2007-05-16 CA is aware that two functional exploit code samples were publicized on May 16, 2007. These two denial of service exploits are associated with vulnerabilities in CA BrightStor ARCserve Backup Mediasvr.exe and caloggerd.exe. We have verified that vulnerabilities do exist, and we are now working on a patch to address the issues. We have given these vulnerabilities a Medium risk rating. To mitigate the Mediasvr.exe vulnerability, CA recommends that BrightStor ARCserve Backup users implement the following temporary workaround: 1. Rename the "mediasvr.exe" file to a non-functional file name, such as "mediasvc.exe.disable". 2. Then restart the CA BrightStor Tape Engine service. This will disable the command line functionality in the product (i.e. command line utilities such as ca_backup, ca_restore, ca_merge, ca_qmgr, ca_scan, etc will not work). After we have completed our analysis of these issues, we will post an update and patches on the CA SupportConnect website. If additional information is required, please contact CA Technical Support at http://supportconnect.ca.com. If you discover a vulnerability in CA products, please report your findings to vuln AT ca DOT com, or utilize our "Submit a Vulnerability" form at http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx Regards, Ken Williams ; 0xE2941985 Director, CA Vulnerability Research CA, 1 CA Plaza, Islandia, NY 11749 Contact http://www.ca.com/us/contact/ Legal Notice http://www.ca.com/us/legal/ Privacy Policy http://www.ca.com/us/privacy/ Copyright (c) 2007 CA. All rights reserved.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top