Several vulnerabilities have been reported in BrightStor ARCserve Backup, which can be exploited by malicious people to compromise a vulnerable system.

1) An error in the handling of opnum 0xBF RPC requests within the Tape Engine service can be exploited to execute arbitrary code via a specially crafted RPC request sent to the service (default port 6502/TCP).

2) A boundary error in the handling of opnum 0x2F and opnum 0x75 RPC requests within the Message Engine RPC service can be exploited to cause a buffer overflow via a specially crafted RPC request sent to the service (default ports 6503/TCP and 6504/TCP).

3) A boundary error in the handling of opnum 0xCF RPC requests to the Tape Engine RPC service can be exploited to cause a buffer overflow via a specially crafted RPC request sent to the service (default port 6503/TCP).

4) Two boundary errors in the handling of RPC requests within the Mediasrv.exe service can be exploited to cause a stack-based buffer overflow via a specially crafted RPC request sent to the service.

5) A boundary error within ASCORE.dll when handling opnum 0x2F RPC requests within the Message Engine RPC service can be exploited to cause a stack-based buffer overflow via a specially crafted RPC request sent to the service (default ports 6503/TCP and 6504/TCP).

Successful exploitation of the vulnerabilities allow execution of arbitrary code.

Solution
Apply fixes:
Further details available in Customer Area

Provided and/or discovered by
1) Discovered by LSsecurity and reported via ZDI.
2-3) Discovered by Tenable Network Security and reported via ZDI.
4) Paul Mehta, IBM Internet Security Systems X-Force
5) Discovered by an anonymous person and reported via iDefense Labs.

Changelog
Further details available in Customer Area

Original Advisory
CA:
http://supportconnectw.ca.com/public/storage/infodocs/babimpsec-notice.asp

LSsecurity:
http://livesploit.com/advisories/LS-20061002.pdf

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-002.html
http://www.zerodayinitiative.com/advisories/ZDI-07-003.html
http://www.zerodayinitiative.com/advisories/ZDI-07-004.html

IBM ISS:
http://www.iss.net/threats/252.html
http://www.iss.net/threats/253.html

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=467

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area