-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Title: CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities CA Advisory Reference: CA20090615-01 CA Advisory Date: 2009-06-15 Reported By: iViZ Security Research Team Impact: A remote attacker can cause a denial of service. Summary: CA ARCserve Backup contains multiple vulnerabilities in the message engine that can allow a remote attacker to cause a denial of service. CA has issued an update to address the vulnerabilities. The vulnerabilities, CVE-2009-1761, occur due to insufficient verification of data sent to the message engine. An attacker can make requests that can cause the message engine to crash. Mitigating Factors: None Severity: CA has given these vulnerabilities a Medium risk rating. Affected Products: CA ARCserve Backup r12.0 Windows CA ARCserve Backup r12.0 SP 1 Windows Non-Affected Products: CA ARCserve Backup r11.5 SP 4 Windows CA ARCserve Backup r12.0 SP 2 Windows CA ARCserve Backup r12.5 Affected Platforms: Windows Status and Recommendation: CA has issued the following patches to address the vulnerabilities. CA ARCserve Backup r12.0, r12.0 SP1 Windows: Install Service Pack 2 RO08383. How to determine if the installation is affected: CA ARCserve Backup r12.0, r12.0 SP1 Windows: 1. Run the ARCserve Patch Management utility. From the Windows Start menu, the program can be found under Programs->CA->ARCserve Patch Management->Patch Status. 2. The main patch status screen will indicate if the patch in the below table is applied. If the patch is not applied, then the installation is vulnerable. Product Patch CA ARCserve Backup r12.0, r12.0 SP1 Windows RO08383 For more information on the ARCserve Patch Management utility, read document TEC446265. Workaround: None References (URLs may wrap): CA Support: https://support.ca.com/ CA20090615-01: Security Notice for CA ARCserve Backup Message Engine https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=2095 02 Solution Document Reference APARs: RO08383, TEC446265 CA Security Response Blog posting: CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15.aspx Reported By: iViZ Security Research Team http://www.ivizsecurity.com/security-advisory-iviz-sr-09003.html http://www.ivizsecurity.com/security-advisory-iviz-sr-09004.html CVE References: CVE-2009-1761 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1761 OSVDB References: Pending http://osvdb.org/ Changelog for this advisory: v1.0 - Initial Release Customers who require additional information should contact CA Technical Support at https://support.ca.com. For technical questions or comments related to this advisory, please send email to vuln AT ca DOT com. If you discover a vulnerability in CA products, please report your findings to the CA Product Vulnerability Response Team. https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782 Regards, Ken Williams, Director ; 0xE2941985 CA Product Vulnerability Response Team CA, 1 CA Plaza, Islandia, NY 11749 Contact http://www.ca.com/us/contact/ Legal Notice http://www.ca.com/us/legal/ Privacy Policy http://www.ca.com/us/privacy/ Copyright (c) 2009 CA. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.10.0 (Build 500) Charset: utf-8 wj8DBQFKN4KLeSWR3+KUGYURAme/AJwOT497kNgqXAGFzXuwRVfxUSYJ5QCfWQ7G e2A9SJJB53CpJi3mE37Cw3g= =KMJo -----END PGP SIGNATURE-----