Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

ARCserve Backup lets attackers run code remotely

CVE-2007-0449 · published 19 years ago
Summary

Certain versions of ARCserve Backup for laptops, desktops, mobile backup, and business protection can be tricked into running malicious code when they receive specially crafted network messages on ports 1900 or 2200. This could let an outsider take control of the affected server. Install the latest updates from Broadcom or disable the affected services until the patches are applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
broadcom brightstor_arcserve_backup_laptops_desktops 11.0
11.1
cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.0:*:*:*:*:*:*:*
broadcom brightstor_mobile_backup r4.0
cpe:2.3:a:broadcom:brightstor_mobile_backup:r4.0:*:*:*:*:*:*:*
broadcom business_protection_suite 2.0
cpe:2.3:a:broadcom:business_protection_suite:2.0:*:*:*:*:*:*:*
broadcom desktop_management_suite 11.0
11.1
cpe:2.3:a:broadcom:desktop_management_suite:11.0:*:*:*:*:*:*:*
broadcom desktop_protection_suite 2.0
cpe:2.3:a:broadcom:desktop_protection_suite:2.0:*:*:*:*:*:*:*
Original advisory text
Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r4.0, Desktop and Business Protection Suite r2, and Deskto...
Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r4.0, Desktop and Business Protection Suite r2, and Desktop Management Suite (DMS) r11.0 and r11.1 allow remote attackers to execute arbitrary code via crafted packets to TCP port (1) 1900 or (2) 2200.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
80% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published23 Jan 2007
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2007-0449 · NVD
Track software like this
Free during beta