Vulnerability Description
Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup R11.5 Server before SP2 allows remote attackers to execute arbitrary code in the Tape Engine (tapeeng.exe) via a crafted RPC request with (1) opnum 38, which is not properly handled in TAPEUTIL.dll 11.5.3884.0, or (2) opnum 37, which is not properly handled in TAPEENG.dll 11.5.3884.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Broadcom | Brightstor Arcserve Backup Server | 11.5 |
References
- http://supportconnectw.ca.com/public/storage/infodocs/basbrtapeeng-secnotice.asp
- http://www.lssec.com/advisories/LS-20060908.pdf
- http://www.lssec.com/advisories/LS-20061001.pdf
- http://www.securityfocus.com/archive/1/453930/30/390/threaded
- http://www.securityfocus.com/archive/1/453933/30/420/threaded
- http://www.securityfocus.com/archive/1/454088/30/0/threaded
- http://www.securityfocus.com/archive/1/454094/30/360/threaded
- http://www.securityfocus.com/archive/1/456428/100/0/threaded
- http://www.securityfocus.com/archive/1/456711
- http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?cid=97428
- http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34959
- https://www.exploit-db.com/exploits/3086
- http://supportconnectw.ca.com/public/storage/infodocs/basbrtapeeng-secnotice.asp
- http://www.lssec.com/advisories/LS-20060908.pdf
- http://www.lssec.com/advisories/LS-20061001.pdf
FAQ
What is CVE-2006-6917?
CVE-2006-6917 is a vulnerability with a CVSS score of 10.0 (HIGH). Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup R11.5 Server before SP2 allows remote attackers to execute arbitrary code in the Tape Engine (tapeeng.exe) via a crafte...
How severe is CVE-2006-6917?
CVE-2006-6917 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-6917?
Check the references section above for vendor advisories and patch information. Affected products include: Broadcom Brightstor Arcserve Backup Server.