Some vulnerabilities have been reported in BrightStor ARCserve Backup, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerabilities are caused due to boundary errors within the SUN RPC service when processing RPC strings. These can be exploited to cause stack-based buffer overflows via specially crafted RPC strings sent to the service.

Successful exploitation allows execution of arbitrary code.

The vulnerabilities affect the following products and versions:
* BrightStor ARCserve Backup r11.5
* BrightStor ARCserve Backup r11.1
* BrightStor ARCserve Backup r11 for Windows
* BrightStor Enterprise Backup r10.5
* BrightStor ARCserve Backup v9.01
* CA Server Protection Suite r2
* CA Business Protection Suite r2
* CA Business Protection Suite for Microsoft Small Business Server Standard Edition r2
* CA Business Protection Suite for Microsoft Small Business Server Premium Edition r2

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
Discovered by Tenable Network Security and reported via ZDI.

Changelog
Further details available to Secunia VIM customers

Original Advisory
CA:
http://supportconnectw.ca.com/public/storage/infodocs/babmedser-secnotice.asp

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-022.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers