Vulnerability CVE-2006-6379 - CERT Civis.Net

Vulnerability Name:

CVE-2006-6379 (CCN-30791)

Assigned:

2006-12-07

Published:

2006-12-07

Updated:

2021-04-09

Summary:

Buffer overflow in the BrightStor Backup Discovery Service in multiple CA products, including ARCserve Backup r11.5 SP1 and earlier, ARCserve Backup 9.01 up to 11.1, Enterprise Backup 10.5, and CA Server Protection Suite r2, allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:TF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.6 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:TF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: Full-Disclosure Mailing List, Fri Dec 08 2006 - 11:57:52 CST
[CAID 34846]: CA BrightStor ARCserve Backup Discovery Service Buffer Overflow Vulnerability

Source: MITRE
Type: CNA
CVE-2006-6379

Source: SREASON
Type: UNKNOWN
2010

Source: CCN
Type: SECTRACK ID: 1017356
BrightStor ARCserve Backup Buffer Overflow in Discovery Service Lets Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1017356

Source: CCN
Type: CA SupportConnect Web site
Important Security Notice for BrightStor ARCserve Backup

Source: CONFIRM
Type: Vendor Advisory
http://supportconnectw.ca.com/public/storage/infodocs/babsecurity-notice.asp

Source: CCN
Type: IBM Internet Security Systems Protection Alert, Dec 12, 2006
CA BrightStor ARCserve Backup Discovery Service Buffer Overflow

Source: OSVDB
Type: UNKNOWN
30775

Source: CCN
Type: OSVDB ID: 30775
CA BrightStor ARCserve Backup Discovery Service Overflow

Source: BUGTRAQ
Type: UNKNOWN
20061208 [CAID 34846]: CA BrightStor ARCserve Backup Discovery Service Buffer Overflow Vulnerability

Source: BID
Type: Vendor Advisory
21502

Source: CCN
Type: BID-21502
CA Multiple BrightStor ARCserve Backup Discovery Service Remote Buffer Overflow Vulnerability

Source: VUPEN
Type: UNKNOWN
ADV-2006-4910

Source: XF
Type: UNKNOWN
brightstor-arcserv-discovery-bo(30791)

Source: XF
Type: UNKNOWN
brightstor-arcserv-discovery-bo(30791)

Vulnerable Configuration:

Configuration 1:

cpe:/a:broadcom:brightstor_arcserve_backup:11.5:sp1:*:*:*:*:*:*

OR cpe:/a:broadcom:brightstor_arcserve_backup:9.01:*:*:*:*:*:*:*

OR cpe:/a:broadcom:brightstor_arcserve_backup:11:*:*:*:*:*:*:*

OR cpe:/a:broadcom:brightstor_enterprise_backup:10.5:*:*:*:*:*:*:*

OR cpe:/a:broadcom:server_protection_suite:2:*:*:*:*:*:*:*

OR cpe:/a:broadcom:brightstor_arcserve_backup:11.1:*:*:*:*:*:*:*

OR cpe:/a:broadcom:brightstor_arcserve_backup:11.5:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:broadcom:brightstor_enterprise_backup:10.5:*:*:*:*:*:*:*

OR cpe:/a:ca:brightstor_arcserve_backup:11.0:*:*:*:*:*:*:*

OR cpe:/a:broadcom:brightstor_arcserve_backup:11.1:*:*:*:*:*:*:*

OR cpe:/a:broadcom:server_protection_suite:2:*:*:*:*:*:*:*

OR cpe:/a:broadcom:brightstor_arcserve_backup:11.5:*:*:*:*:*:*:*

OR cpe:/a:broadcom:brightstor_arcserve_backup:9.01:*:*:*:*:*:*:*

OR cpe:/a:broadcom:brightstor_arcserve_backup:11.5:sp1:*:*:*:*:*:*

Denotes that component is vulnerable