Home / vulnerabilities cabright-help.txt
Posted on 17 May 2007
Source : packetstormsecurity.org Link
Title: CA BrightStor ARCserve Backup Mediasvr.exe and
caloggerd.exe Vulnerabilities
Notice Date: 2007-05-16
CA is aware that two functional exploit code samples were
publicized on May 16, 2007. These two denial of service exploits
are associated with vulnerabilities in CA BrightStor ARCserve
Backup Mediasvr.exe and caloggerd.exe.
We have verified that vulnerabilities do exist, and we are now
working on a patch to address the issues. We have given these
vulnerabilities a Medium risk rating.
To mitigate the Mediasvr.exe vulnerability, CA recommends that
BrightStor ARCserve Backup users implement the following temporary
workaround:
1. Rename the "mediasvr.exe" file to a non-functional file
name, such as "mediasvc.exe.disable".
2. Then restart the CA BrightStor Tape Engine service.
This will disable the command line functionality in the product
(i.e. command line utilities such as ca_backup, ca_restore,
ca_merge, ca_qmgr, ca_scan, etc will not work).
After we have completed our analysis of these issues, we will post
an update and patches on the CA SupportConnect website. If
additional information is required, please contact CA Technical
Support at http://supportconnect.ca.com.
If you discover a vulnerability in CA products, please report your
findings to vuln AT ca DOT com, or utilize our "Submit a
Vulnerability" form at
http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx
Regards,
Ken Williams ; 0xE2941985
Director, CA Vulnerability Research
CA, 1 CA Plaza, Islandia, NY 11749
Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2007 CA. All rights reserved.
