TSRT-06-11: CA Multiple Product DBASVR RPC Server Multiple Buffer Overflow Vulnerabilities

[TSRT@xxxxxxxx]

TSRT-06-11: CA Multiple Product DBASVR RPC Server Multiple Buffer
            Overflow Vulnerabilities
http://www.tippingpoint.com/security/advisories/TSRT-06-11.html
October  5, 2006

-- CVE ID:
CVE-2006-5143

-- Affected Vendor:
Computer Associates

-- Affected Products:
BrightStor ARCserve Backup R11.5 Client
BrightStor ARCserve Backup R11.5 Server
BrightStor Enterprise Backup 10.5
BrightStor ARCserve Backup v9.01
CA Server Protection Suite r2
CA Business Protection Suite r2

-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability since March 27, 2006 by Digital Vaccine protection
filter ID 4268. For further product information on the TippingPoint IPS:

    http://www.tippingpoint.com 

-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Computer Associates BrightStor ARCserve
Backup, Enterprise Backup, Server Protection Suite and Business
Protection Suite. Authentication is not required to exploit this
vulnerability and both client and servers are affected.

The problem specifically exists within DBASVR.exe, the Backup Agent RPC
Server. This service exposes a number of vulnerable RPC routines through
a TCP endpoint with ID 88435ee0-861a-11ce-b86b-00001b27f656 on port
6071. The most trivial of the exposed vulnerabilities results in an
exploitable stack overflow.

The vulnerable routines include:

   /* opcode: 0x01, address: 0x00401A70 */
 
   long   sub_401A70 (
    [in][string] char * arg_1,
    [in][string] char * arg_2,       // stack overflow
    [out][size_is(8192), length_is(*arg_4)] char * arg_3,
    [in, out] long * arg_4
   );


   /* opcode: 0x02, address: 0x00401CC0*/
 
   long   sub_401CC0 (
    [in][string] char * arg_1,
    [in][string] char * arg_2,      // stack overflow
    [in][string] char * arg_3,
    [out] long * arg_4
   );


   /* opcode: 0x18, address: 0x004041C0*/
 
   long   sub_4041C0 (
    [in][string] char * arg_1,
    [in][string] char * arg_2,      // stack overflow
    [out] long * arg_3
   );

The first two vulnerable subroutines are the result of inline
strcpy()/memcpy()'s. The third vulnerable subroutine is due to an
insecure call to lstrcat().

-- Vendor Response:
Computer Associates has issued an update to correct this vulnerability.
More details can be found at:
 
    supportconnectw.ca.com/public/storage/infodocs/basbr-secnotice.asp

-- Disclosure Timeline:
2006.03.27 - Digital Vaccine released to TippingPoint customers
2006.03.28 - Vulnerability reported to vendor
2006.10.05 - Coordinated public release of advisory

-- Credit:
This vulnerability was discovered by Pedram Amini, TippingPoint Security
Research Team.