> [Full-disclosure] CA BrightStor ARCserve Backup Tape Engine > Exploit Security Notice > TheGesus thegesus at gmail.com > Wed Jan 10 16:38:47 GMT 2007 > >>On 1/9/07, Williams, James K <James.Williams at ca.com> wrote: >> >>[...] >> CA BrightStor ARCserve Backup Tape Engine Exploit Security >> Notice >> >> CA is aware that exploit code for a vulnerability in the Tape >> Engine component of CA BrightStor ARCserve Backup was posted on >> several security web sites and mailing lists on January 5, >> 2007. This vulnerability is fixed in BrightStor ARCserve Backup >> r11.5 Service Pack 2, and a patch for earlier versions of >> ARCserve will be available shortly. >>[...] >> Reference (URL may wrap): >> http://supportconnectw.ca.com/public/storage/infodocs/basbrtapeeng-secnotice.asp >> >> Regards, >> Ken >> >> Ken Williams ; 0xE2941985 >> Director, CA Vulnerability Research >>[...] >> > >TRANSLATION: don't hold your breath waiting for a patch. >
Agreed. Two days is quite a bit longer than the current competitive static apnea world record of 9 min 04 sec. Patches for all other releases of BrightStor ARCserve Backup are now available via SupportConnect. http://SupportConnect.ca.com BAB r11.5 – QO84983 BAB r11.1 – QO84984 BAB r11.0 – QI82917 BEB r10.5 – QO84986 BAB v9.01 – QO84985 A formal advisory will be sent out later today. Regards, Ken Ken Williams ; 0xE2941985 Director, CA Vulnerability Research _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/