Vulnerabilities > CVE-2007-0169 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Broadcom products

#
# (C) Tenable Network Security, Inc.
#

# BAB r11.5 - QO84983
# BAB r11.1 - QO84984
# BAB r11.0 - QI82917
# BEB r10.5 - QO84986
# BAB v9.01 - QO84985


include("compat.inc");

if (description)
{
 script_id(24013);
 script_version("1.21");
 script_cvs_date("Date: 2018/11/15 20:50:26");

 script_cve_id("CVE-2006-6076", "CVE-2007-0168", "CVE-2007-0169");
 script_bugtraq_id(21221, 22006, 22010);

 script_name(english:"CA BrightStor ARCserve Backup Tape Engine Multiple Remote Overflows (QO84983)");
 script_summary(english:"Check buffer overflow in BrightStor ARCServe for Windows");

 script_set_attribute(attribute:"synopsis", value:
"Arbitrary code can be executed on the remote host.");
 script_set_attribute(attribute:"description", value:
"This host is running BrightStor ARCServe for Windows.

The remote version of this software has multiple buffer overflow
vulnerabilities in the Tape Engine MSRPC service. 

An attacker, by sending a specially crafted packet, may be able to
crash the affected service or execute code on the remote host.");
 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?543ab108");
 script_set_attribute(attribute:"see_also", value:"https://www.securityfocus.com/archive/1/452222/30/0/threaded");
 script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-07-002/");
 script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-07-004/");
 # https://web.archive.org/web/20070117230030/http://supportconnectw.ca.com/public/storage/infodocs/babimpsec-notice.asp
 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9fda01ee");
 script_set_attribute(attribute:"solution", value:"Apply security patch QO84983.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
 script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");
 script_set_attribute(attribute:"exploit_framework_core", value:"true");
 script_set_attribute(attribute:"metasploit_name", value:'CA BrightStor ARCserve Message Engine Buffer Overflow');
 script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

 script_set_attribute(attribute:"plugin_publication_date", value:"2007/01/12");
 script_set_attribute(attribute:"patch_publication_date", value:"2007/01/11");
 script_set_attribute(attribute:"vuln_publication_date", value:"2006/10/07");

 script_set_attribute(attribute:"plugin_type", value:"remote");
 script_set_attribute(attribute:"cpe", value:"cpe:/a:ca:arcserve_backup");
 script_end_attributes();

 script_category(ACT_GATHER_INFO);
 script_family(english:"Windows");
 script_copyright(english:"This script is Copyright (C) 2007-2018 Tenable Network Security, Inc.");

 script_require_ports(6502);
 exit(0);
}


include ('smb_func.inc');

function RPC_Bind ()
{
 local_var ret, resp, soc;

 soc = session_get_socket ();

 ret = dce_rpc_bind(cid:session_get_cid(), uuid:"62b93df0-8b02-11ce-876c-00805f842837", vers:1);
 send (socket:soc, data:ret);
 resp = recv (socket:soc, length:4096);

 if (!resp)
   return -1;

 ret = dce_rpc_parse_bind_ack (data:resp);
 if (isnull (ret) || (ret != 0))
   return -1;

 return 0;
}


function RPCNewFSDevice ()
{
 local_var data, ret, resp, val, soc;

 soc = session_get_socket ();

 session_set_unicode (unicode:0);

 data = 
	raw_dword (d:1) +
	class_name (name:crap(data:"A", length:0x10)) ;

 session_set_unicode (unicode:1);

 ret = dce_rpc_request (code:0xCF, data:data);
 send (socket:soc, data:ret);
 resp = recv (socket:soc, length:4096);

 resp = dce_rpc_parse_response (data:resp);
 if (strlen(resp) != 4)
   return 0;

 # patch -> if (strlen(s) > 8) return 0x1d
 val = get_dword (blob:resp, pos:0);
 if (val != 0x1d)
   return 1;

 return 0;
}



port = 6502;
if ( ! get_port_state(port) ) exit(0);
soc = open_sock_tcp (port);
if (!soc) exit (0);

session_init (socket:soc);

ret = RPC_Bind ();
if (ret != 0)
  exit (0);

ret = RPCNewFSDevice ();
if (ret != 0)
  security_hole(port);

close (soc);

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(24015);
  script_version("1.24");
  script_cvs_date("Date: 2018/11/15 20:50:26");

  script_cve_id("CVE-2006-5171","CVE-2006-5172","CVE-2006-6076","CVE-2006-6917","CVE-2007-0168","CVE-2007-0169");
  script_bugtraq_id(21221, 22005, 22006, 22010, 22015, 22016);

  script_name(english:"CA BrightStor ARCserve Backup Multiple Vulnerabilities (QO84983)");
  script_summary(english:"Checks version of BrightStor ARCserve Backup");

  script_set_attribute(attribute:"synopsis", value:
"The remote software is affected by multiple vulnerabilities." );
  script_set_attribute(attribute:"description", value:
"According to its version, the installation of BrightStor ARCserve
Backup on the remote host is affected by multiple buffer overflows
that can be exploited by an unauthenticated, remote attacker to execute
arbitrary code on the affected host with SYSTEM privileges." );
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e175e643" );
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?543ab108" );
  script_set_attribute(attribute:"see_also", value:"https://www.securityfocus.com/archive/1/456711/30/0/threaded" );
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?25216527" );
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch as described in the vendor advisory." );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'CA BrightStor ARCserve Message Engine Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_publication_date", value:"2007/01/15");
  script_set_attribute(attribute:"vuln_publication_date", value:"2006/11/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ca:arcserve_backup");
  script_end_attributes();
 
  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");
  script_copyright(english:"This script is Copyright (C) 2007-2018 Tenable Network Security, Inc.");

  script_dependencies("arcserve_discovery_service_detect.nasl");
  script_require_keys("ARCSERVE/Discovery/Version");

  exit(0);
}

include("global_settings.inc");
include("misc_func.inc");


ver = get_kb_item("ARCSERVE/Discovery/Version");
if (isnull(ver)) exit(0);


matches = eregmatch(string:ver, pattern:"^[a-z]([0-9]+\.[0-9]+) \(build ([0-9]+)\)$");
if (!isnull(matches))
{
  ver = matches[1];
  build = int(matches[2]);

  if (
    (ver == "11.5" && build < 4235) ||
    (ver == "11.1" && build < 3207) ||
    # nb: QI82917 says there's no patch for 11.0; the solution is to 
    #     upgrade to 11.1 and then apply QO84984.
    (ver == "11.0") ||
    # nb: QO84986 doesn't exist.
    (ver == "10.5") ||
    (ver == "9.0" && build < 2204)
  )
  {
    # Issue a report for each open TCP port.
    tcp_ports = make_list(
      111,                             # Mediasvr service
      6502,                            # Tape Engine
      6503,                            # Message Engine
      6504                             # Message Engine
    );
    foreach port (tcp_ports)
    {
      # Make sure the port is open.
      if (get_port_state(port) && service_is_unknown(port:port))
      {
        soc = open_sock_tcp(port);
        if (soc)
        {
          close(soc);
          security_hole(port);
        }
      }
    }
    udp_ports = make_list(
      111                              # Mediasvr service
    );
    foreach port (udp_ports)
    {
      security_hole(port:port, proto:"udp");
    }
  }
}