-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

AusCERT Update AU-2007.0026 - [Win]
CA BrightStor ARCserve Backup Security Notice
7 December 2007        AusCERT Update Summary
        ----------------------

Product:              BrightStor ARCserve Backup r11.5
                      BrightStor ARCserve Backup r11.1
                      BrightStor ARCserve Backup r11 for Windows
                      BrightStor Enterprise Backup r10.5
                      BrightStor ARCserve Backup v9.01
                      CA Server Protection Suite r2
                      CA Business Protection Suite r2
                      CA Business Protection Suite for Microsoft Small Business
                        Server Standard Edition r2
                      CA Business Protection Suite for Microsoft Small Business
                        Server Premium Edition r2
Operating System:     Windows
Impact:               Execute Arbitrary Code/Commands
                      Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-5327
Member content until: Friday, January 04 2008

Ref:                  ESB-2007.0786

Original Bulletin:  
  http://supportconnectw.ca.com/public/storage/infodocs/basb-secnotice.asp

Comment: CA has released updated patches as the previous patches did not
         correct the issue properly.

- --------------------------BEGIN INCLUDED TEXT--------------------

BrightStor ARCserve Backup Security Notice

Issued: October 10, 2007
Last Updated: December 06, 2007

Note: Updated patches are available. The original patches did not fully 
address some issues.

CA's technical support is alerting customers to security risks associated 
with BrightStor ARCserve Backup. Multiple vulnerabilities exist that can allow
 a remote attacker to cause a denial of service, execute arbitrary code, or 
take privileged action. CA has issued patches to address the vulnerabilities.

The first set of vulnerabilities, CVE-2007-5325, CVE-2007-5326, and 
CVE-2007-5327, occur due to insufficient bounds checking by multiple
components.

The second vulnerability, CVE-2007-5328, occurs due to privileged functions 
being available for use without proper authorization.

The third set of vulnerabilities, CVE-2007-5329, CVE-2007-5330, CVE-2007-5331,
and CVE-2007-5332, are due to a memory corruption occurring with the 
processing of RPC procedure arguments by multiple services. The 
vulnerabilities allow an attacker to cause a denial of service, or potentially
to execute arbitrary code.


Risk Rating

High

Affected Products

BrightStor ARCserve Backup r11.5
BrightStor ARCserve Backup r11.1
BrightStor ARCserve Backup r11 for Windows
BrightStor Enterprise Backup r10.5
BrightStor ARCserve Backup v9.01
CA Server Protection Suite r2
CA Business Protection Suite r2
CA Business Protection Suite for Microsoft Small Business Server 
  Standard Edition r2
CA Business Protection Suite for Microsoft Small Business Server 
  Premium Edition r2

How to determine if the installation is affected

   1. Using Windows Explorer, locate the file "asdbapi.dll". By default, 
      the file is located in the "C:\Program Files\CA\BrightStor ARCserve 
      Backup" directory.

   2. Right click on the file and select Properties.

   3. Select the General tab.

   4. If the file timestamp is earlier than indicated in the below table, the
      installation is vulnerable.


      Product Version 	File Name 	Timestamp 	File Size
      11.5 	asdbapi.dll 	10/24/2007 08:43:08 	1249354 bytes
      11.1 	asdbapi.dll 	10/19/2007 17:56:00 	856064 bytes
      9.01 	asdbapi.dll 	10/19/2007 18:02:22 	700416 bytes


      * For Protection Suites r2, follow instructions for BrightStor ARCserve 
        Backup r11.5 

Solution

CA has issued the following patches to address the vulnerabilities.

BrightStor ARCserve Backup r11.5 - QO92996
BrightStor ARCserve Backup r11.1, - QO92849
BrightStor ARCserve Backup r11.0 - Upgrade to 11.1 and apply the latest
   patches.
BrightStor Enterprise Backup r10.5 - Upgrade to 11.5 and apply the latest
   patches.
BrightStor ARCserve Backup v9.01 - QO92848
CA Protection Suites r2: QO92996

Workaround

None

References

CVE-2007-5325 - Message Engine and AScore.dll buffer overflows
CVE-2007-5326 - RPC and rpcx.dll buffer overflows
CVE-2007-5327 - Message Engine buffer overflows
CVE-2007-5328 - Privileged function exposure
CVE-2007-5329 - dbasvr memory corruption
CVE-2007-5330 - RPC service memory corruption
CVE-2007-5331 - lqserver and media server memory corruption
CVE-2007-5332 - mediasvr and caloggerd memory corruption

Acknowledgement

CVE-2007-5325 - An anonymous researcher working with the iDefense VCP
CVE-2007-5326 - Dyon Balding of Secunia Research
CVE-2007-5327 - cocoruder of Fortinet Security Research Team
CVE-2007-5328 - Tenable Network Security
CVE-2007-5329 - Pedram Amini of DV Labs (dvlabs.tippingpoint.com)
CVE-2007-5330 - Dyon Balding of Secunia Research
CVE-2007-5331 - eEye Digital Security
CVE-2007-5332 - shirkdog

Special thanks to Dyon Balding of Secunia and to Fortinet for reporting issues
with the original patches.

Change History

Version 1.0: Initial Release
Version 1.1: Provided updated patch information, modified file information in 
"How to determine if the installation is affected" section.

If additional information is required, please contact CA Technical Support at 
http://supportconnect.ca.com.

If you discover a vulnerability in CA products, please report your findings to
 vuln AT ca DOT com, or utilize our "Submit a Vulnerability" form at 
http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBR1jSYyh9+71yA2DNAQKcpAP/f6eswCFCDm9hruSccZVA2JbxhrcpwnMG
XIXNjUot3FLuRZ9guOOe4W3CFHJflnC1bpcFk9qSeA2pcG0/LmCRBGYFiXnnd8sF
dm7gotAi8wm6EbRjj8ekjvNWEO1XwEmaF4BBQVvKyfsK+vNoRcq/hcpuZPXWFv13
Xak3o3z8/8g=
=J/F3
-----END PGP SIGNATURE-----