Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

ARCserve Backup can run code remotely via crafted RPC data

CVE-2007-2139 · published 19 years ago
Summary

The ARCserve Backup and related BrightStor products contain a flaw in their SUN RPC service that can be triggered by specially crafted network messages. An attacker could cause the software to execute any code they choose, potentially taking control of the server. Apply the vendor’s security update or upgrade to a patched version as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
broadcom brightstor_arcserve_backup 9.01
11.1
11.5
cpe:2.3:a:broadcom:brightstor_arcserve_backup:9.01:*:*:*:*:*:*:*
broadcom business_protection_suite 2.0
cpe:2.3:a:broadcom:business_protection_suite:2.0:*:*:*:*:*:*:*
broadcom server_protection_suite 2
cpe:2.3:a:broadcom:server_protection_suite:2:*:*:*:*:*:*:*
ca brightstor_arcserve_backup 11
cpe:2.3:a:ca:brightstor_arcserve_backup:11:*:windows:*:*:*:*:*
ca business_protection_suite 2.0
cpe:2.3:a:ca:business_protection_suite:2.0:*:microsoft_sbs_premium:*:*:*:*:*
Original advisory text
Multiple stack-based buffer overflows in the SUN RPC service in CA (formerly Computer Associates) BrightStor ARCserve Media Server, as used in BrightStor ARCserve Backup 9.01 through 11.5 SP2, Brig...
Multiple stack-based buffer overflows in the SUN RPC service in CA (formerly Computer Associates) BrightStor ARCserve Media Server, as used in BrightStor ARCserve Backup 9.01 through 11.5 SP2, BrightStor Enterprise Backup 10.5, Server Protection Suite 2, and Business Protection Suite 2, allow remote attackers to execute arbitrary code via malformed RPC strings, a different vulnerability than CVE-2006-5171, CVE-2006-5172, and CVE-2007-1785.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
78% chance of attack within 30 days
Timeline
Published25 Apr 2007
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2007-2139 · NVD
Track software like this
Free during beta