DESCRIPTION
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Computer Associates BrightStor ARCserve Backup, Enterprise Backup, Server Protection Suite and Business Protection Suite. Authentication is not required to exploit this vulnerability and both client and servers are affected.

The problem specifically exists within DBASVR.exe, the Backup Agent RPC Server. This service exposes a number of vulnerable RPC routines through a TCP endpoint with ID:

    88435ee0-861a-11ce-b86b-00001b27f656

on port 6071. The most trivial of the exposed vulnerabilities results in an exploitable stack overflow.

The vulnerable routines include:

   /* opcode: 0x01, address: 0x00401A70 */
   
   long   sub_401A70 (
    [in][string] char * arg_1,
    [in][string] char * arg_2,       // stack overflow
    [out][size_is(8192), length_is(*arg_4)] char * arg_3,
    [in, out] long * arg_4
   );


   /* opcode: 0x02, address: 0x00401CC0*/
   
   long   sub_401CC0 (
    [in][string] char * arg_1,
    [in][string] char * arg_2,      // stack overflow
    [in][string] char * arg_3,
    [out] long * arg_4
   );


   /* opcode: 0x18, address: 0x004041C0*/
   
   long   sub_4041C0 (
    [in][string] char * arg_1,
    [in][string] char * arg_2,      // stack overflow
    [out] long * arg_3
   );

The first two vulnerable subroutines are the result of inline strcpy() / memcpy()'s. The third vulnerable subroutine is due to an insecure call to lstrcat().

TippingPoint Advisory