Home page logo

fulldisclosure logo Full Disclosure mailing list archives

CA BrightStor ARCserve Backup Mediasvr.exe vulnerability
From: "Williams, James K" <James.Williams () ca com>
Date: Fri, 30 Mar 2007 20:59:39 -0400

CA is aware that functional exploit code was publicized on 
March 30, 2007 for a CA BrightStor ARCserve Backup Mediasvr.exe 

We have verified that a high risk vulnerability does exist and we 
are now working on a patch to address the issue. 

CA recommends that BrightStor ARCserve Backup users implement the 
following temporary workaround to mitigate the vulnerability: 

1) Rename the "mediasvr.exe" file to a non-functional file name, 
   such as "mediasvc.exe.disable".

2) Then restart the CA BrightStor Tape Engine service.

This will disable the command line functionality in the product 
(i.e. command line utilities such as ca_backup, ca_restore, 
ca_merge, ca_qmgr, ca_scan, etc will not work).

After we have completed our analysis of the issue, we will post 
an update and patches on the CA SupportConnect website. If 
additional information is required, please contact CA Technical 
Support at http://supportconnect.ca.com.

If you discover a vulnerability in CA products, please report 
your findings to vuln at ca dot com, or utilize our "Submit a 
Vulnerability" form at 

Ken Williams ; 0xE2941985
Director, CA Vulnerability Research

CA, One CA Plaza, Islandia, NY 11749
Contact http://www3.ca.com/contact/
Legal Notice http://www3.ca.com/legal/
Privacy Policy http://www3.ca.com/privacy/
Copyright (c) 2007 CA. All rights reserved.
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]