Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Assurent VR - CA ARCserve Backup for Laptops and Desktops LGServer Handshake Buffer Overflow
From: VR-Subscription-noreply () assurent com
Date: Thu, 31 Jul 2008 12:27:36 -0400 (EDT)

CA ARCserve Backup for Laptops and Desktops LGServer Handshake Buffer Overflow

Assurent ID: FSC20080731-12

1. Affected Software

CA ARCserve Backup for Laptops and Desktops version r11.5
CA ARCserve Backup for Laptops and Desktops version r11.1 SP2
CA ARCserve Backup for Laptops and Desktops version r11.1 SP1
CA ARCserve Backup for Laptops and Desktops version r11.1
CA ARCserve Backup for Laptops and Desktops version r11.0
CA Desktop Management Suite version 11.2
CA Desktop Management Suite version 11.1
CA Protection Suites version r2
CA Protection Suites version 3.0
CA Protection Suites version 3.1

Reference: http://ca.com/smb/product.aspx?id=5286

2. Vulnerability Summary

There exists a buffer overflow vulnerability in the way CA ARCserve Backup for Laptops and Desktops handles incoming 
messages. The vulnerability is due to an integer underflow in the LGServer service.

3. Vulnerability Analysis

A remote unauthenticated attacker may exploit the vulnerability by sending a malicious request to LGServer service on 
TCP port 1900. Successful exploitation would allow the attacker to cause a denial of service condition, potentially 
inject and execute arbitrary code with privileges of the affected service.

4. Vulnerability Detection

Assurent has confirmed the vulnerability in:

CA ARCserve Backup for Laptops and Desktops version r11.5
CA ARCserve Backup for Laptops and Desktops version r11.1 SP2
CA ARCserve Backup for Laptops and Desktops version r11.1 SP1
CA ARCserve Backup for Laptops and Desktops version r11.1
CA ARCserve Backup for Laptops and Desktops version r11.0
CA Desktop Management Suite version 11.2
CA Desktop Management Suite version 11.1
CA Protection Suites version r2
CA Protection Suites version 3.0
CA Protection Suites version 3.1

5. Workaround

Apply the vendor patch or block communication from untrusted networks to affected assets.

6. Vendor Response

CA has released a bulletin addressing this vulnerability. 

Reference: https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181721

7. Disclosure Timeline

  2008-05-30 Reported to vendor
  2008-05-30 Initial vendor response
  2008-07-31 Coordinated public disclosure

8. Credits

Vulnerability Research Team, Assurent Secure Technologies, a TELUS company

9. References

  CVE: CVE-2008-3175
  Vendor: 181721

10. About Assurent VRS

Assurent's Vulnerability Research Service (VRS) for security product vendors, and Threat Protection Programs (TPP) for 
MSPs and enterprise security teams, help to eliminate the significant costs incurred by security product vendors, MSPs, 
and enterprise security teams in responding to and managing critical new security vulnerabilities and other threats 
including worm & virus outbreaks and high-risk spyware. The VRS and TPP services are real-time feeds providing 
subscribers with detailed analysis of the top security vulnerabilities, focused on the specific needs of each group of 
customers. 

http://www.assurent.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Assurent VR - CA ARCserve Backup for Laptops and Desktops LGServer Handshake Buffer Overflow VR-Subscription-noreply (Jul 31)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]