|
|
|
|
| |
Credit:
The information has been provided by iDefense Labs Security Advisories.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=599
|
| |
Vulnerable Systems:
* ARCServe Backup for Laptops and Desktops version 11.1 (Build 900)
The LGServer contains multiple vulnerable functions that handle network requests, several of which contain more than one vulnerability. All together there are nearly 60 buffer overflows in the LGServer.
The majority of these are the result of copying remotely supplied strings into fixed-size buffers without validating that enough space is available. A list of vulnerable commands follows.
rxsAddNewUser, rxsSetUserInfo, rxsRenameUser, rxsSetMessageLogSettings, rxsExportData, rxsSetServerOptions, rxsRenameFile, rxsACIManageSend, rxsExportUser, rxsImportUser, rxsMoveUserData, rxsUseLicenseIni, rxsLicGetSiteId, rxsGetLogFileNames, rxsGetBackupLog, rxsBackupComplete, rxsSetDataProtectionSecurityData, rxsSetDefaultConfigName, rxsGetMessageLogSettings, rxsHWDiskGetTotal, rxsHWDiskGetFree, rxsGetSubDirs, rxsGetServerDBPathName, rxsSetServerOptions, rxsDeleteFile, rxsACIManageSend, rxcReadBackupSetList, rxcWriteConfigInfo, rxcSetAssetManagement, rxcWriteFileListForRestore, rxcReadSaveSetProfile, rxcInitSaveSetProfile, rxcAddSaveSetNextAppList, rxcAddSaveSetNextFilesPathList, rxcAddNextBackupSetIncWildCard, rxcGetRevisions, rxrAddMovedUser, rxrSetClientVersion
By sending requests for the above functions with specially crafted parameters, it is possible to cause a buffer overflow. Although most involve stack based buffers, several involve heap based buffers.
Additionally, a stack based buffer overflow vulnerability exists in the GetUserInfo() function. This function is a utility function that is
used by many of the request handling functions. It is possible to trigger this vulnerability by passing a long user name parameter to this function.
Another stack based buffer overflow exists within the handler for the rxrLogin request. As its name suggests, this command logs in the user after reading in the name and password. This handler contains several unsafe calls to wsprintf(). By providing a long user name it is possible to overflow a fixed size stack based buffer.
Analysis:
Exploitation allows an attacker to execute arbitrary code with SYSTEM privileges.
In order to exploit these vulnerabilities, an attacker must be able to establish a TCP session with the LGServer on port 1900. Unsuccessful exploitation attempts will crash the server, which will not restart automatically.
All of these vulnerabilities, with the exception of those in the rxrLogin command, should only be able to be triggered by an authenticated server administrator. However, due to the authentication bypass vulnerability described in a previous iDefense advisory any unauthenticated user can trigger them.
Vendor response:
Computer Associates has addressed these vulnerabilities with an update. For more information consult CA's security notice at the following URL. http://supportconnectw.ca.com/public/sams/lifeguard/infodocs/caarcservebld-securitynotice.asp
CVE Information:
CVE-2007-5003 and CVE-2007-3216
Disclosure Timeline:
03/21/2007 - Initial vendor notification
03/21/2007 - Initial vendor response
09/20/2007 - Public disclosure
|
|
|
|
|
