TippingPoint Digital Vaccine Laboratories
DID YOU KNOW... TippingPoint customers were protected against 0-day exploitation of MS07-017 two years prior to the exploit being discovered in the wild.

CA Multiple Product DBASVR RPC Server Multiple Buffer Overflow Vulnerabilities

TPTI-06-11: October 5th, 2006

CVE ID

Affected Vendors

Affected Products

TippingPoint™ IPS Customer Protection

TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 4268. For further product information on the TippingPoint IPS:

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Computer Associates BrightStor ARCserve Backup, Enterprise Backup, Server Protection Suite and Business Protection Suite. Authentication is not required to exploit this vulnerability and both client and servers are affected.

The problem specifically exists within DBASVR.exe, the Backup Agent RPC Server. This service exposes a number of vulnerable RPC routines through a TCP endpoint with ID 88435ee0-861a-11ce-b86b-00001b27f656 on port 6071. The most trivial of the exposed vulnerabilities results in an exploitable stack overflow.

The vulnerable routines include:

/* opcode: 0x01, address: 0x00401A70 */

long sub_401A70 (
[in][string] char * arg_1,
[in][string] char * arg_2, // stack overflow
[out][size_is(8192), length_is(*arg_4)] char * arg_3,
[in, out] long * arg_4
);


/* opcode: 0x02, address: 0x00401CC0*/

long sub_401CC0 (
[in][string] char * arg_1,
[in][string] char * arg_2, // stack overflow
[in][string] char * arg_3,
[out] long * arg_4
);


/* opcode: 0x18, address: 0x004041C0*/

long sub_4041C0 (
[in][string] char * arg_1,
[in][string] char * arg_2, // stack overflow
[out] long * arg_3
);

The first two vulnerable subroutines are the result of inline strcpy()/memcpy()'s. The third vulnerable subroutine is due to an insecure call to lstrcat().

Vendor Response

Computer Associates has issued an update to correct this vulnerability. More details can be found at:

Disclosure Timeline

    2006-03-28 - Vulnerability reported to vendor
    2006-10-05 - Coordinated public release of advisory

Credit

This vulnerability was discovered by: