Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2008.0773 -- [Win]
CA ARCserve Backup for Laptops and Desktops Server LGServer
Service Vulnerability
4 August 2008
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: CA ARCserve Backup for Laptops and Desktops
CA Desktop Management Suite
CA Protection Suites
Publisher: CA
Operating System: Windows
Impact: Execute Arbitrary Code/Commands
Access: Remote/Unauthenticated
CVE Names: CVE-2008-3175
- --------------------------BEGIN INCLUDED TEXT--------------------
Title: CA ARCserve Backup for Laptops and Desktops Server LGServer
Service Vulnerability
CA Advisory Date: 2008-07-31
Reported By: Vulnerability Research Team of Assurent Secure
Technologies, a TELUS Company
Impact: A remote attacker can execute arbitrary code or cause a
denial of service condition.
Summary: CA ARCserve Backup for Laptops and Desktops server
contains a vulnerability that can allow a remote attacker to
execute arbitrary code or cause a denial of service condition. CA
has issued updates to address the vulnerability. The vulnerability,
CVE-2008-3175, occurs due to insufficient bounds checking by the
LGServer service. An attacker can make a request that can result
in arbitrary code execution or crash the service.
Mitigating Factors: Only the server installation of BrightStor
ARCserve Backup for Laptops and Desktops is affected. The client
installation is not affected.
Severity: CA has given this vulnerability a High risk rating.
Affected Products:
CA ARCserve Backup for Laptops and Desktops r11.5
CA ARCserve Backup for Laptops and Desktops r11.1 SP2
CA ARCserve Backup for Laptops and Desktops r11.1 SP1
CA ARCserve Backup for Laptops and Desktops r11.1
CA ARCserve Backup for Laptops and Desktops r11.0
CA Desktop Management Suite 11.2
CA Desktop Management Suite 11.1
CA Protection Suites r2
CA Protection Suites 3.0
CA Protection Suites 3.1
Affected Platforms:
Windows
Status and Recommendation:
CA has provided the following updates to address the vulnerability.
CA ARCserve Backup for Laptops and Desktops 11.1, 11.1 SP1, 11.1
SP2:
Upgrade to 11.1 SP2 and apply RO00912.
CA ARCserve Backup for Laptops and Desktops 11.5:
RO00913.
CA Protection Suites 3.0:
RO00912.
CA Protection Suites 3.1:
RO00912.
CA Desktop Management Suite 11.2:
Upgrade to CA Desktop Management Suite 11.2 C1 and apply RO00913.
CA Desktop Management Suite 11.1:
RO01150.
CA ARCserve Backup for Laptops and Desktops 11.0:
Upgrade to ARCserve Backup for Laptops and Desktops version 11.1
SP2 and apply the latest patches.
QI85497.
Note: CA Protection Suites r2 includes CA ARCserve Backup for
Laptops and Desktops 11.0.
How to determine if you are affected:
For Windows:
1. Using Windows Explorer, locate the file "rxRPC.dll". The file
can be found in the following default locations:
CA ARCserve Backup for Laptops and Desktops 11.5:
C:\Program Files\CA\BrightStor ARCserve Backup for Laptops and
Desktops\Server
CA ARCserve Backup for Laptops and Desktops 11.1, 11.1 SP1,
11.1 SP2:
C:\Program Files\CA\BrightStor ARCserve Backup for Laptops &
Desktops\server
CA Protection Suites 3.0:
C:\Program Files\CA\BrightStor ARCserve Backup for Laptops &
Desktops\server
CA Protection Suites 3.1:
C:\Program Files\CA\BrightStor ARCserve Backup for Laptops &
Desktops\server
CA Desktop Management Suite 11.2:
C:\Program Files\CA\Unicenter DSM\BABLD\Server
CA Desktop Management Suite 11.1:
C:\Program Files\CA\Unicenter DSM\BABLD\Server
2. Right click on the file and select Properties.
3. Select the General tab.
4. If the file date is earlier than indicated in the below table,
the installation is vulnerable.
CA ARCserve Backup for Laptops and Desktops
File Name File Size (bytes) File Date
rxRPC.dll 131,072 June 11, 2008
CA ARCserve Backup for Laptops and Desktops 11.1, 11.1 SP1, 11.1
SP2
File Name File Size (bytes) File Date
rxRPC.dll 114,688 June 11, 2008
CA Protection Suites 3.0
File Name File Size (bytes) File Date
rxRPC.dll 114,688 June 11, 2008
CA Protection Suites 3.1
File Name File Size (bytes) File Date
rxRPC.dll 114,688 June 11, 2008
CA Desktop Management Suite 11.2
File Name File Size (bytes) File Date
rxRPC.dll 131,072 June 11, 2008
CA Desktop Management Suite 11.1
File Name File Size (bytes) File Date
rxRPC.dll 122,880 June 11, 2008
Workaround: None
References (URLs may wrap):
CA Support:
http://support.ca.com/
Security Notice for CA ARCserve Backup for Laptops and Desktops
Server LGServer
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181721
Solution Document Reference APARs:
RO00912, RO00913, RO01150, QI85497
CA Security Response Blog posting:
CA ARCserve Backup for Laptops and Desktops Server LGServer
Service Vulnerability
community.ca.com/blogs/casecurityresponseblog/archive/2008/08/01.aspx
Reported By:
Vulnerability Research Team of Assurent Secure Technologies, a
TELUS Company.
http://www.assurent.com/
CVE References:
CVE-2008-3175 - LGServer buffer overflow
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3175
OSVDB References: Pending
http://osvdb.org/
Changelog for this advisory:
v1.0 - Initial Release
Customers who require additional information should contact CA
Technical Support at http://support.ca.com.
For technical questions or comments related to this advisory,
please send email to vuln AT ca DOT com.
If you discover a vulnerability in CA products, please report your
findings to our product security response team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782
Regards,
Ken Williams ; 0xE2941985
Director, CA Vulnerability Research
CA, 1 CA Plaza, Islandia, NY 11749
Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2008 CA. All rights reserved.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBSJaHOyh9+71yA2DNAQIVUQP/WKVfnS0bCq/bBoL0ba9/C11imIjHeoKh
okbQSqDplcsHBixpv1nZzUtnB5RxifRovOnMzLEPdEpQQMzYhXPDhup2RLJF8+Ja
bLu8ocDLDXAPU48expTB3Y3rM/Yc6YzDy800t+GXbS3+UbfOprer0WIkB0JH7gAi
zF71WjAw9Pg=
=KXVe
-----END PGP SIGNATURE-----