Security Watch | Matt Hines » Researchers up ante of CA exploits

May 17, 2007 | Comments: (0)

Researchers up ante of CA exploits

TAGS: Security

Security researchers have upgraded a vulnerability bulletin issued by software maker CA to a "high severity" rating despite the company's initial report that that exploits designed to attack the flaw posed merely a "medium" risk to users.

On May 16, CA released a bulletin detailing two functional denial-of-service exploit code samples discovered in the wild by researchers affecting its back-up software.

The two denial-of-service exploits are specifically associated with vulnerabilities in CA's BrightStor ARCserve Backup "Mediasvr.exe" and "caloggerd.exe" programs.

"We have verified that vulnerabilities do exist, and we are now working on a patch to address the issues," the company said in its bulletin. "We have given these vulnerabilities a medium risk rating."

In the mean time, CA has offered a workaround that addresses the problem until it can release a patch via its SupportConnect Web site after it finishes analyzing the problems.

However, security experts with eEye Digital Security, led by CTO Marc Maiffret, are warning that the exploits actually pose a more significant risk than CA has indicated.

With only slight modification of the code, said Maiffret, the exploits can be made remotely exploitable and hard to ward off.

"Although the proof-of-concept does not reach an exploitable condition, mildly altering the proof-of-concept will," eEye said in a bulletin posted to its Web site. "The vendor has labeled the specific denial of service vulnerabilities with a medium severity. However, because of the simplicity to demonstrate an exploitable condition by altering the supplied proof of concept, eEye Research is designating these vulnerabilities as high severity."

The company said that if altered, the vulnerability can be exploited anonymously against BrightStor, allowing for a remote attacker to run arbitrary code in order to obtain full system access.

The security company said that it is also currently searching for any active exploitation of the vulnerabilities.

Reached for comment, CA officials said they would examine eEye's research and update the existing product warning if the security company is proven correct.

"We are reviewing the information provided by eEye Research, and will publish an update on the CA SupportConnect website if their findings are validated," the company said via e-mail.

Posted by Matt Hines on May 17, 2007 02:26 PM

RATE THIS ARTICLE: