Re: CA BrightStor ARCserve Backup Tape Engine Exploit Security Notice

["Williams, James K" <James.Williams () ca com>]

> [Full-disclosure] CA BrightStor ARCserve Backup Tape Engine 
> Exploit Security Notice
> TheGesus thegesus at gmail.com
> Wed Jan 10 16:38:47 GMT 2007
>
> > On 1/9/07, Williams, James K <James.Williams at ca.com> wrote:
> >
> > [...]
> > CA BrightStor ARCserve Backup Tape Engine Exploit Security 
> > Notice
> >
> > CA is aware that exploit code for a vulnerability in the Tape
> > Engine component of CA BrightStor ARCserve Backup was posted on
> > several security web sites and mailing lists on January 5, 
> > 2007. This vulnerability is fixed in BrightStor ARCserve Backup 
> > r11.5 Service Pack 2, and a patch for earlier versions of 
> > ARCserve will be available shortly.
> > [...]
> > Reference (URL may wrap):
> > http://supportconnectw.ca.com/public/storage/infodocs/basbrtapeeng-secnotice.asp
> >
> > Regards,
> > Ken
> >
> > Ken Williams ; 0xE2941985
> > Director, CA Vulnerability Research
> > [...]
>
> TRANSLATION: don't hold your breath waiting for a patch.

Agreed.  Two days is quite a bit longer than the current 
competitive static apnea world record of 9 min 04 sec.

Patches for all other releases of BrightStor ARCserve Backup are 
now available via SupportConnect.
http://SupportConnect.ca.com

BAB r11.5 – QO84983
BAB r11.1 – QO84984
BAB r11.0 – QI82917
BEB r10.5 – QO84986
BAB v9.01 – QO84985

A formal advisory will be sent out later today.

Regards,
Ken
                                                           
Ken Williams ; 0xE2941985
Director, CA Vulnerability Research

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/