Technical Description

Multiple vulnerabilities have been identified in CA ARCserve Backup for Laptops and Desktops and CA Desktop Management Suite, which could be exploited by remote attackers to cause a denial of service or take complete control of an affected system.

The first issue is caused by an error in the LGServer service when processing user-supplied command arguments, which could be exploited by attackers to crash an affected application or execute arbitrary code.

The second vulnerability is caused by an input validation error in the NetBackup service when processing file uploads, which could be exploited by attackers to execute arbitrary code.

Affected Products

CA ARCserve Backup for Laptops and Desktops r11.5
CA ARCserve Backup for Laptops and Desktops r11.1 SP2
CA ARCserve Backup for Laptops and Desktops r11.1 SP1
CA ARCserve Backup for Laptops and Desktops r11.1
CA ARCserve Backup for Laptops and Desktops r11.0
CA Desktop Management Suite 11.2 English
CA Desktop Management Suite 11.2 localized
CA Desktop Management Suite 11.1

Solution

Apply patch for CA ARCserve Backup for Laptops and Desktops 11.1, 11.1 SP1, and 11.2 SP2:
https://support.ca.com/irj/portal/kbsrch?allDoc=T&keywordType=1&reqtype=2&searchText=QO95512

Apply patch for CA ARCserve Backup for Laptops and Desktops 11.5:
https://support.ca.com/irj/portal/kbsrch?allDoc=T&keywordType=1&reqtype=2&searchText=QO95513

Apply patch for CA Desktop Management Suite 11.2 English:
https://support.ca.com/irj/portal/kbsrch?allDoc=T&keywordType=1&reqtype=2&searchText=QO95513

Apply patch for CA Desktop Management Suite 11.2 localized:
https://support.ca.com/irj/portal/kbsrch?allDoc=T&keywordType=1&reqtype=2&searchText=QO95513

CA Desktop Management Suite 11.1 - Upgrade to 11.1 C1

CA ARCserve Backup for Laptops and Desktops 11.0 - Upgrade to ARCserve Backup for Laptops and Desktops version 11.1 and apply the latest patches:
https://support.ca.com/irj/portal/kbsrch?allDoc=T&keywordType=1&reqtype=2&searchText=QI85497

References

http://www.vupen.com/english/advisories/2008/1104
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=173105

Credits

Vulnerabilities reported by Dyon Balding (Secunia Research).

ChangeLog

2008-04-03 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.