CA backup and recovery solution contains flaws

The flaws, discovered by the X-Force research and development team at IBM Internet Security Systems (ISS), are found in CA Brightstor ARCserve, a storage solution largely deployed by small- and medium-size businesses.

According to IBM ISS advisories released today, the two bugs are similar and can be exploited through a stack-based buffer overflow. This could lead to the exposure of confidential information, loss in productivity and a compromised network.

Pete Allor, director of intelligence at IBM ISS, said organisations should take the vulnerabilities seriously because they affect products that manage mission-critical data.

"CA Brightstor ARCserve is widely deployed in corporate environments," he said. "Since it is normally used for the protection and recovery of mission-critical applications, and since these two vulnerabilities are not difficult to exploit, ISS recommends that companies using CA Brightstor ARCserve patch immediately."

A CA spokesman told SCMagazine.com today that the company has patched the flaws and that it was not aware of any customers being affected.

andbackupcacontainsflawsrecoverysecuritysolution