Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
SecuriTeam™  Beyond Security®  SecuriTeam™ Home  Ask the Team  Mailing Lists  Advertising Info  Blogs SecuriTeam™ in Your Inbox   E-mail this CVE-2007-5328 to a friend New vulnerability? New tool? Tell us	CVE-2007-5328 CA BrightStor ARCserve Backup Message Engine Insecure Method Exposure Vulnerability     Credit: The information has been provided by The Zero Day Initiative (ZDI). The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-07-069.html Website Security Scan Code Vulnerability Test Network Assessment Tool Detect hidden vulnerabilities Exhaustive automated testing Real-time, continuous security Get guidance from professionals of internal or 3rd party code. scanning for your entire network    CVE-2007-5328 Details Check for CVE-2007-5328 Vulnerability Assessment and Management. Automated Pen Testing for 50 to 50,000 nodes beyondsecurity.com/vulnerability-scanner Vulnerable Systems:  * BrightStor ARCserve Backup r11.5  * BrightStor ARCserve Backup r11.1  * BrightStor ARCserve Backup r11.0  * BrightStor Enterprise Backup r10.5  * BrightStor ARCserve Backup version 9.01 The specific flaws exists in the Message Engine RPC service which listens by default on TCP port 6504 with the following UUID:     506b1890-14c8-11d1-bbc3-00805fa6962e The service exposes a number of insecure method calls including: 0x17F, 0x180, 0x181, 0x182, 0x183, 0x184, 0x185, 0x186, 0x187, 0x188, 0x189, 0x18A, 0x18B, and 0x18C. Attackers can leverage these methods to manipulate both the file system and registry which can result in a complete system compromise. Vendor Response: Computer Associates has issued an update to correct this vulnerability. More details can be found at: http://supportconnectw.ca.com/public/storage/infodocs/basb-secnotice.asp CVE Information: CVE-2007-5328 Disclosure Timeline: 2007.01.12 - Vulnerability reported to vendor 2007.11.26 - Coordinated public release of advisory  Comments on CVE-2007-5328:  Add new comment:  Subject:  Name/Nick/Email:          Chars Left:	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus

Copyright © 1998-2010 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®