CVE-2007-0169
Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allow remote attackers to execute arbitrary code via RPC requests with crafted data…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 70.0%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allow remote attackers to execute arbitrary code via RPC requests with crafted data for opnums (1) 0x2F and (2) 0x75 in the (a) Message Engine RPC service, or opnum (3) 0xCF in the Tape Engine service.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 70.04% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- broadcom/brightstor arcserve backup · broadcom/brightstor enterprise backup · broadcom/business protection suite
- Source
- cve@mitre.org
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=467
- http://osvdb.org/31327
- http://secunia.com/advisories/23648Vendor Advisory
- http://securitytracker.com/id?1017506
- http://supportconnectw.ca.com/public/storage/infodocs/babimpsec-notice.aspPatch
- http://www.kb.cert.org/vuls/id/151032US Government Resource
- http://www.kb.cert.org/vuls/id/180336US Government Resource
- http://www.securityfocus.com/archive/1/456618/100/0/threaded
- http://www.securityfocus.com/archive/1/456619/100/0/threaded
- http://www.securityfocus.com/archive/1/456711
- http://www.securityfocus.com/bid/22005
- http://www.securityfocus.com/bid/22006
- http://www.vupen.com/english/advisories/2007/0154Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-07-003.htmlExploit
- http://www.zerodayinitiative.com/advisories/ZDI-07-004.htmlExploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31433
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31443
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=467
- http://osvdb.org/31327
- http://secunia.com/advisories/23648Vendor Advisory
- http://securitytracker.com/id?1017506
- http://supportconnectw.ca.com/public/storage/infodocs/babimpsec-notice.aspPatch
- http://www.kb.cert.org/vuls/id/151032US Government Resource
- http://www.kb.cert.org/vuls/id/180336US Government Resource
- http://www.securityfocus.com/archive/1/456618/100/0/threaded
- http://www.securityfocus.com/archive/1/456619/100/0/threaded
- http://www.securityfocus.com/archive/1/456711
- http://www.securityfocus.com/bid/22005
- http://www.securityfocus.com/bid/22006
- http://www.vupen.com/english/advisories/2007/0154Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.