-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2006.0120 -- AUSCERT ALERT
                        [Win][UNIX/Linux][Netware]
        CA ARCserve Backup and Protection Suite products - multiple
                          remote vulnerabilities
                             12 December 2006

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              BrightStor ARCserve Backup r11.5 SP1 and prior, r11.1 and v9.01
                      BrightStor ARCserve Backup for Windows r11
                      BrightStor Enterprise Backup r10.5
                      CA Server Protection Suite r2
                      CA Business Protection Suite r2
                      CA Business Protection Suite for Microsoft Small Business Server Standard Edition r2
                      CA Business Protection Suite for Microsoft Small Business Server Premium Edition r2
Operating System:     Windows
                      UNIX variants (UNIX, Linux)
                      NetWare
Impact:               Administrative Compromise
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-6076 CVE-2006-6379
Member content until: Tuesday, January 09 2007

Ref:                  AL-2006.0110


OVERVIEW:

	1. CVE-2006-6379 Windows platform

	   Multiple CA products that install the BrightStor Backup Discovery 
	   Service are vulnerable to remote compromise via a buffer overflow. 
	   This affects both client and server systems running any of the 
	   products listed above. [1]

	2. CVE-2006-6076 All platforms

	   CA has also acknowledged three remote vulnerabilities reported 
	   in BrightStor ARCserve Backup server on all operating system 
	   platforms, and urges customers to upgrade to Service Pack 2. 

	   These include the vulnerability previously reported in AL-2006.0110, 
	   and two further format string vulnerabilities in the Tape Engine 
	   component of the server (tapeeng.exe). [2][3][4]


IMPACT:

	1. Both client and server computers running the vulnerable products
	   may be remotely compromised by an attacker, allowing execution of 
	   arbitrary code with SYSTEM privileges.

	2. A remote attacker who can send data to TCP port 6502 on the server
	   can compromise the server, executing arbitrary code with SYSTEM
	   privileges, then may potentially restore malicious code to all 
	   backup clients.


MITIGATION:

	Patches are now available from CA fixing these vulnerabilities. [1]

	BrightStor ARCserve Backup servers should be upgraded to Service Pack 2, 
	which is not vulnerable.

	As with any backup product, access to client ports used for backup should 
	be restricted to the backup server, and vice versa for server ports. All 
	backup service ports should not be accessible from outside your organisation.


REFERENCES:

	[1] CA Security Notice
	    http://supportconnectw.ca.com/public/storage/infodocs/babsecurity-notice.asp

	[2] AusCERT Alert AL-2006.0110
	    https://www.auscert.org.au/7004

	[3] LSsecurity advisories LS-20060908, LS-20061001, LS-20061113
	    http://www.lssec.com/advisories.html

	[4] CA Vulnerability Research response
	    http://www.securityfocus.com/archive/1/454094/30/0/threaded


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRX4uMCh9+71yA2DNAQInzQP8CS9C1HZZdnWKKwpozWCqUY9B2tpTnTA5
DINr1eDMU8aT8U7or91E1eaYetqa1OJS+iIKL1c0thxzc+sHxZbsJOFCxsFQMCtL
OxqH2IbneD2sn68Ybd6IJVriWTDFeeInPc2cG1lrZy7TQ+XRzvHdd2zsU/0Bk26q
xGooiQNPcRs=
=iviQ
-----END PGP SIGNATURE-----