CVSS: 10.0EPSS: 9%CPEs: 15EXPL: 0CVE-2008-3175
https://notcve.org/view.php?id=CVE-2008-3175
Integer underflow in rxRPC.dll in the LGServer service in the server in CA ARCserve Backup for Laptops and Desktops 11.0 through 11.5 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted message that triggers a buffer overflow. Subdesbordamiento de enteros en la biblioteca rxRPC.dll en el servicio LGServer en el servidor en CA ARCserve Backup versiones 11.0 hasta 11.5 para ordenadores Portátiles y Escritorios, permite a los atacantes remotos ejecutar código arbitrario o causar una denegación de servicio por medio de un mensaje diseñado que desencadena un desbordamiento de búfer. • http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063594.html http://secunia.com/advisories/31319 http://www.securityfocus.com/archive/1/495020/100/0/threaded http://www.securityfocus.com/bid/30472 http://www.securitytracker.com/id?1020590 http://www.vupen.com/english/advisories/2008/2286 https://exchange.xforce.ibmcloud.com/vulnerabilities/44137 https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181721 • CWE-189: Numeric Errors •
CVSS: 10.0EPSS: 30%CPEs: 7EXPL: 0CVE-2008-2241 – CA BrightStor ARCserve Backup caloggerd Arbitrary File Writing Vulnerability
https://notcve.org/view.php?id=CVE-2008-2241
Directory traversal vulnerability in caloggerd in CA BrightStor ARCServe Backup 11.0, 11.1, and 11.5 allows remote attackers to append arbitrary data to arbitrary files via directory traversal sequences in unspecified input fields, which are used in log messages. NOTE: this can be leveraged for code execution in many installation environments by writing to a startup file or configuration file. Vulnerabilidad de salto de directorio en caloggerd de BrightStor ARCServe Backup 11.0, 11.1 y 11.5, permite a atacantes remotos añadir datos a archivos arbitrariamente a través de secuencias de salto de directorio en archivos de entrada no especificados, que son utilizados en mensajes de log. NOTA: puede aprovecharse para ejecución de código en muchos entornos de instalación escribiendo en un fichero archivo de inicio o en un archivo de configuración. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Computer Associates ARCserve Backup. • http://secunia.com/advisories/30300 http://www.securityfocus.com/archive/1/492266/100/0/threaded http://www.securityfocus.com/archive/1/492274/100/0/threaded http://www.securityfocus.com/bid/29283 http://www.securitytracker.com/id?1020043 http://www.vupen.com/english/advisories/2008/1573/references http://www.zerodayinitiative.com/advisories/ZDI-08-027 https://exchange.xforce.ibmcloud.com/vulnerabilities/42524 https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=176798 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 90%CPEs: 3EXPL: 0CVE-2008-2242 – CA BrightStor ARCserve Backup XDR Parsing Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2008-2242
Multiple buffer overflows in xdr functions in the server in CA BrightStor ARCServe Backup 11.0, 11.1, and 11.5 allow remote attackers to execute arbitrary code, as demonstrated by a stack-based buffer overflow via a long parameter to the xdr_rwsstring function. Múltiples desbordamientos de buffer de las funciones xdr en el servidor de CA BrightStor ARCServe Backup 11.0, 11.1 y 11.5, permiten a atacantes remotos ejecutar código arbitrariamente, tal y como se ha demostrado mediante un desbordamiento de búfer basado en pila a través de un parámetro largo de la función xdr_rwsstring. This vulnerability allws attackers to execute arbitrary code on vulnerable installations of CA BrightStor ARCserve Backup for Linux. User interaction is not required to exploit this vulnerability. The specific flaw exists due to improper bounds checking in the xdr_rwsstring() library function. By sending a long parameter into a daemon using this function to process strings, a stack based buffer overflow occurs, leading to execution of arbitrary code. • http://secunia.com/advisories/30300 http://www.securityfocus.com/archive/1/492274/100/0/threaded http://www.securityfocus.com/archive/1/492291/100/0/threaded http://www.securityfocus.com/bid/29283 http://www.securitytracker.com/id?1020044 http://www.vupen.com/english/advisories/2008/1573/references http://www.zerodayinitiative.com/advisories/ZDI-08-026 https://exchange.xforce.ibmcloud.com/vulnerabilities/42527 https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=176798 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.0EPSS: 19%CPEs: 8EXPL: 1CVE-2007-4620 – Computer Associates - Alert Notification Buffer Overflow
https://notcve.org/view.php?id=CVE-2007-4620
Multiple stack-based buffer overflows in Computer Associates (CA) Alert Notification Service (Alert.exe) 8.1.586.0, 8.0.450.0, and 7.1.758.0, as used in multiple CA products including Anti-Virus for the Enterprise 7.1 through r11.1 and Threat Manager for the Enterprise 8.1 and r8, allow remote authenticated users to execute arbitrary code via crafted RPC requests. Múltiples desbordamientos de buffer basados en pila del servicio Computer Associates (CA) Alert Notification Service (Alert.exe) 8.1.586.0, 8.0.450.0 y 7.1.758.0, usado en varios productos CA incluyendo Anti-Virus para la versión Enterprise 7.1 a la r11.1 y Threat Manager para la versión Enterprise 8.1 y r8, permiten a usuarios autenticados ejecutar código de su elección mediante peticiones RPC manipuladas. • https://www.exploit-db.com/exploits/16410 http://community.ca.com/blogs/casecurityresponseblog/archive/2008/04/04/ca-alert-notification-server-multiple-vulnerabilities.aspx http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=679 http://secunia.com/advisories/29665 http://securityreason.com/securityalert/3799 http://www.securityfocus.com/archive/1/490466/100/0/threaded http://www.securityfocus.com/bid/28605 http://www.securitytracker.com/id?1019789 http://www.securitytracker.com/id&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 3%CPEs: 9EXPL: 0CVE-2007-5331
https://notcve.org/view.php?id=CVE-2007-5331
Queue.dll for the message queuing service (LQserver.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows remote attackers to execute arbitrary code via a malformed ONRPC protocol request for operation 0x76, which causes ARCserve Backup to dereference arbitrary pointers. La biblioteca Queue.dll para el servicio de colas de mensajes (LQserver.exe) en CA BrightStor ARCServe BackUp versión v9.01 hasta R11.5, y Enterprise Backup r10.5, permite a atacantes remotos ejecutar código arbitrario por medio de una petición de protocolo ONRPC malformada para la operación 0x76, lo que hace que ARCserve Backup elimine la referencia de punteros arbitrarios. • http://osvdb.org/41371 http://research.eeye.com/html/advisories/published/AD20071011.html http://secunia.com/advisories/27192 http://supportconnectw.ca.com/public/storage/infodocs/basb-secnotice.asp http://www.securityfocus.com/archive/1/482114/100/0/threaded http://www.securityfocus.com/archive/1/482121/100/0/threaded http://www.securityfocus.com/bid/24680 http://www.securitytracker.com/id?1018805 http://www.vupen.com/english/advisories/2007/3470 https://exchange.xforce.ibmcloud&# • CWE-94: Improper Control of Generation of Code ('Code Injection') •