FKIE_CVE-2007-5003

Vulnerability from fkie_nvd - Published: 2007-10-01 20:17 - Updated: 2025-04-09 00:30
Severity ?
Summary
Multiple stack-based buffer overflows in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allow remote attackers to execute arbitrary code via a long (1) username or (2) password to the rxrLogin command in rxRPC.dll, or a long (3) username argument to the GetUserInfo function.
References
cve@mitre.orghttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=599
cve@mitre.orghttp://research.eeye.com/html/advisories/published/AD20070920.html
cve@mitre.orghttp://secunia.com/advisories/25606Vendor Advisory
cve@mitre.orghttp://supportconnectw.ca.com/public/sams/lifeguard/infodocs/caarcservebld-securitynotice.aspPatch
cve@mitre.orghttp://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=156006Patch
cve@mitre.orghttp://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35674Patch
cve@mitre.orghttp://www.securityfocus.com/archive/1/480252/100/100/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/24348
cve@mitre.orghttp://www.securitytracker.com/id?1018728
af854a3a-2127-422b-91ae-364da2661108http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=599
af854a3a-2127-422b-91ae-364da2661108http://research.eeye.com/html/advisories/published/AD20070920.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25606Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://supportconnectw.ca.com/public/sams/lifeguard/infodocs/caarcservebld-securitynotice.aspPatch
af854a3a-2127-422b-91ae-364da2661108http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=156006Patch
af854a3a-2127-422b-91ae-364da2661108http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35674Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/480252/100/100/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/24348
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1018728
Impacted products
Vendor Product Version
broadcom brightstor_arcserve_backup_laptops_desktops 4.0
broadcom brightstor_arcserve_backup_laptops_desktops 11.0
broadcom brightstor_arcserve_backup_laptops_desktops 11.1
broadcom brightstor_arcserve_backup_laptops_desktops 11.1
broadcom brightstor_arcserve_backup_laptops_desktops 11.5
broadcom desktop_management_suite 11.0
broadcom desktop_management_suite 11.1
broadcom desktop_management_suite 11.2
ca protection_suites r2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "261A513C-CBD4-4A1C-B58A-A9005774EC87",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4FB993B2-9A44-40E2-AA05-0CAD04BDC26D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7461AE5-2067-4964-93B7-560CD02CEAC8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.1:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "9DAE8E8B-7FD6-43CB-B07A-6D3B31E94DC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B9C97C1-D295-4A84-B179-3FDF51DE1DD9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:broadcom:desktop_management_suite:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "237F2346-0B9B-4CE8-8EF9-813CB3F1BC1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:broadcom:desktop_management_suite:11.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "22268F99-2F38-481D-A0CC-B1FC96FDB953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:broadcom:desktop_management_suite:11.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6195AFF-0039-4F48-9E02-ACE8CF052EA8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ca:protection_suites:r2:*:*:*:*:*:*:*",
              "matchCriteriaId": "47C10BA4-B241-4F65-8FA1-AD88266C03B0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple stack-based buffer overflows in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allow remote attackers to execute arbitrary code via a long (1) username or (2) password to the rxrLogin command in rxRPC.dll, or a long (3) username argument to the GetUserInfo function."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples desbordamientos de b\u00fafer basado en pila en CA (Computer Associates) BrightStor ARCserve Backup para Port\u00e1til y Sobremesa  r11.0 hasta r11.5 permiten a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n mediante un (1) nombre de usuario \u00f3 (2) contrase\u00f1a largos en el comando rxrLogin de rxRPC.dll, \u00f3 un (3) argumento nombre de usuario largo en la funci\u00f3n GetUserInfo."
    }
  ],
  "id": "CVE-2007-5003",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-10-01T20:17:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=599"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://research.eeye.com/html/advisories/published/AD20070920.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25606"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://supportconnectw.ca.com/public/sams/lifeguard/infodocs/caarcservebld-securitynotice.asp"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=156006"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35674"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/480252/100/100/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/24348"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1018728"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=599"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://research.eeye.com/html/advisories/published/AD20070920.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25606"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://supportconnectw.ca.com/public/sams/lifeguard/infodocs/caarcservebld-securitynotice.asp"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=156006"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35674"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/480252/100/100/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/24348"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1018728"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.