The flaws, discovered by the X-Force research and development team at IBM Internet Security Systems (ISS), are found in CA Brightstor ARCserve, a storage solution largely deployed by small- and medium-size businesses.
According to IBM ISS advisories released today, the two bugs are similar and can be exploited through a stack-based buffer overflow. This could lead to the exposure of confidential information, loss in productivity and a compromised network.
Pete Allor, director of intelligence at IBM ISS, said organisations should take the vulnerabilities seriously because they affect products that manage mission-critical data.
"CA Brightstor ARCserve is widely deployed in corporate environments," he said. "Since it is normally used for the protection and recovery of mission-critical applications, and since these two vulnerabilities are not difficult to exploit, ISS recommends that companies using CA Brightstor ARCserve patch immediately."
A CA spokesman told SCMagazine.com today that the company has patched the flaws and that it was not aware of any customers being affected.
CA backup and recovery solution contains flaws
By Dan Kaplan on Jan 11, 2007 10:36PM