-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2008.0040 -- AUSCERT ALERT
                                   [Win]
         CA ARCserve Backup for Laptops and Desktops Server and CA
             Desktop Management Suite Multiple Vulnerabilities
                               7 April 2008

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              CA ARCserve Backup for Laptops and Desktops r11.5
                      CA ARCserve Backup for Laptops and Desktops r11.1 SP2
                      CA ARCserve Backup for Laptops and Desktops r11.1 SP1
                      CA ARCserve Backup for Laptops and Desktops r11.1
                      CA ARCserve Backup for Laptops and Desktops r11.0
                      CA Desktop Management Suite 11.2 English
                      CA Desktop Management Suite 11.2 localized
                      CA Desktop Management Suite 11.1
Publisher:            CA
Operating System:     Windows
Impact:               Administrator Compromise
                      Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-1329 CVE-2008-1328 CVE-2007-5005
                      CVE-2007-3216

Ref:                  AA-2007.0081

Original Bulletin:
  https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=173105

- --------------------------BEGIN INCLUDED TEXT--------------------

Title: CA ARCserve Backup for Laptops and Desktops Server and CA 
Desktop Management Suite Multiple Vulnerabilities

CA Advisory Date: 2008-04-03

Reported By: Dyon Balding of Secunia Research

Impact: A remote attacker can execute arbitrary code or cause a 
denial of service condition.

Summary: CA ARCserve Backup for Laptops and Desktops Server 
contains multiple vulnerabilities that can allow a remote attacker 
to execute arbitrary code or cause a denial of service condition. 
CA has issued updates to address the vulnerabilities. The first 
issue, CVE-2008-1328, occurs due to insufficient bounds checking 
on command arguments by the LGServer service. The second issue, 
CVE-2008-1329, occurs due to insufficient verification of file 
uploads by the NetBackup service. In most cases, an attacker can 
potentially gain complete control of an affected installation. 
Additionally, only a server installation of BrightStor ARCserve 
Backup for Laptops and Desktops is affected. The client 
installation is not affected.

Note: the previously published patches for CVE-2007-3216 and 
CVE-2007-5005 did not fully address some issues.

Mitigating Factors: Client installations are not affected.

Severity: CA has given these vulnerabilities a maximum risk rating 
of High.

Affected Products:
CA ARCserve Backup for Laptops and Desktops r11.5
CA ARCserve Backup for Laptops and Desktops r11.1 SP2
CA ARCserve Backup for Laptops and Desktops r11.1 SP1
CA ARCserve Backup for Laptops and Desktops r11.1
CA ARCserve Backup for Laptops and Desktops r11.0
CA Desktop Management Suite 11.2 English
CA Desktop Management Suite 11.2 localized
CA Desktop Management Suite 11.1

Affected Platforms:
Windows

Status and Recommendation:
CA has provided updates to address the vulnerabilities.
CA ARCserve Backup for Laptops and Desktops 11.1, 11.1 SP1, 11.2 
   SP2:  QO95512
CA ARCserve Backup for Laptops and Desktops 11.5:  QO95513
CA Desktop Management Suite 11.2 English:  QO95513
CA Desktop Management Suite 11.2 localized:  QO95513
CA Desktop Management Suite 11.1:  Upgrade to 11.1 C1.
CA ARCserve Backup for Laptops and Desktops 11.0:  Upgrade to 
  ARCserve Backup for Laptops and Desktops version 11.1 and apply 
  the latest patches.  QI85497

How to determine if you are affected:

For Windows:
   1. Using Windows Explorer, locate the file "rxRPC.dll". The 
      file can be found in the following default locations:
   Product:  CA ARCserve Backup for Laptops and Desktops 11.5
   Directory Path:  C:\Program Files\CA\BrightStor ARCserve Backup 
      for Laptops & Desktops\Explorer
   Product:  CA ARCserve Backup for Laptops and Desktops 11.1	
   Directory Path:  C:\Program Files\CA\BrightStor ARCserve Backup 
      for Laptops & Desktops\server
   Product:  CA Desktop Management Suite 11.2 English
   Directory Path:  C:\Program Files\CA\DSM\BABLD\MGUI
   Product:  CA Desktop Management Suite 11.2 localized
   Directory Path:  C:\Program Files\CA\DSM\BABLD\MGUI
   2. Right click on the files and select Properties.
   3. Select the General tab.
   4. If the file date is earlier than indicated in the below 
      table, the installation is vulnerable.

Product     File Name     File Date / Size
CA ARCserve Backup for Laptops and Desktops 11.5
   rxRPC.dll     February 18 2008 / 126976
CA ARCserve Backup for Laptops and Desktops 11.1
   rxRPC.dll     February 18 2008 / 114688
CA Desktop Management Suite 11.2 English
   rxRPC.dll     February 18 2008 / 126976
CA Desktop Management Suite 11.2 localized
   rxRPC.dll     February 18 2008 / 126976

Workaround: None

References (URLs may wrap):
CA Support:
http://support.ca.com/
Security Notice for CA ARCserve Backup for Laptops and Desktops 
Server and CA Desktop Management Suite
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=173105
Solution Document Reference APARs:
QO95512, QO95513, QI85497
CA Security Response Blog posting:
CA ARCserve Backup for Laptops and Desktops Server and CA Desktop 
Management Suite Multiple Vulnerabilities
http://community.ca.com/blogs/casecurityresponseblog/archive/2008/04/04/\
ca-arcserve-backup-for-laptops-and-desktops-server-and-ca-desktop-\
management-suite-multiple-vulnerabilities.aspx
Reported By: 
Dyon Balding of Secunia Research
CVE References:
CVE-2008-1328 and CVE-2008-1329
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1328
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1329
OSVDB References: Pending
http://osvdb.org/

Changelog for this advisory:
v1.0 - Initial Release

Customers who require additional information should contact CA
Technical Support at http://support.ca.com.

For technical questions or comments related to this advisory, 
please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your
findings to vuln AT ca DOT com, or utilize our "Submit a 
Vulnerability" form. 
URL: http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx


Regards,
Ken Williams ; 0xE2941985
Director, CA Vulnerability Research

CA, 1 CA Plaza, Islandia, NY 11749
	
Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2008 CA. All rights reserved.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBR/migyh9+71yA2DNAQKnAAP/fhQf2bFmfPHXaLLmv8E7oe67pnisn65u
ExbDtZxB34zAT2g/llolpcMXKG6Do3pWvlRqnFdIiWUo4AetLCjyNJ5N2LZs5fk+
S23KhprlF2LyteLNzkFaGwAXbWVPMQGUDQsqif722CUnwg1fs6bJL+iEKN/fhqHK
KPQyKFKuj3w=
=LojJ
-----END PGP SIGNATURE-----