-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CA20101231-01: Security Notice for CA ARCserve D2D
Issued: December 31, 2010
CA Technologies support is alerting customers to a security risk with CA
ARCserve D2D. A vulnerability exists that can allow a remote attacker to
execute arbitrary code. CA has issued an Information Solution to
address
the vulnerability.
The vulnerability is due to default vulnerabilities inherent in the
Tomcat
and Axis2 3rd party software components. A remote attacker can exploit
the
implementation to execute arbitrary code.
Risk Rating
High
Platform
Windows
Affected Products
CA ARCserve D2D r15
How to determine if the installation is affected
Using Windows Explorer, go to the directory
D2D_HOME\TOMCAT\webapps\WebServiceImpl, and look for the existence
of a
folder called axis2-web.
Solution
A permanent solution will be posted soon at https://support.ca.com/
In the meantime, the following workaround can be implemented to address
the
vulnerability.
1. Stop CA ARCserve D2D Web Service from service control manager.
2. Go to the directory D2D_HOME\TOMCAT\webapps\WebServiceImpl, and
remove the folder axis2-web.
3. Edit D2D_HOME\TOMCAT\webapps\WebServiceImpl\WEB-INF\web.xml, and
remove the content of AxisAdminServlet's servlet and servlet
mapping.
The content to remove will look like the text below:
- servlet
display-nameApache-Axis Admin Servlet Web Admin/display-name
servlet-nameAxisAdminServlet/servlet-name
servlet-classorg.apache.axis2.transport.http.AxisAdminServlet/servlet
-class
load-on-startup100/load-on-startup
/servlet
- servlet-mapping
servlet-nameAxisAdminServlet/servlet-name
url-pattern/axis2-admin/*/url-pattern
/servlet-mapping
4. Change the username and password parameters in the axis2.xml file to
stronger credentials that conform to your organization's password
policies.
D2D_HOME\TOMCAT\webapps\WebServiceImpl\WEB-INF\conf\axis2.xml
parameter name=userNameadmin/parameter
parameter name=passwordaxis2/parameter
5. Start CA ARCserve D2D Web Service.
References
CVE-201X- - CVE Reference Pending
CA ARCserve D2D r15 Web Service Apache Axis2 World Accessible Servlet
Code
Execution Vulnerability Poc Dec 30 2010 11:04AM
http://www.securityfocus.com/archive/1/515494/30/0/threaded
http://marc.info/?l=bugtraqm=129373168501496w=2
Computer Associates ARCserve D2D r15 Web Service Apache Axis2 World
Accessible Servlet Code Execution Vulnerability Poc
http://retrogod.altervista.org/9sg_ca_d2d.html
Acknowledgement
rgod
Change History
Version 1.0: Initial Release
If additional information is required, please contact CA Technologies
Support at https://support.ca.com
If you discover a vulnerability in a CA Technologies product, please
report
your findings to the CA Technologies Product Vulnerability Response
Team.
http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx
Thanks and regards,
Ken Williams, Director
ca technologies Product Vulnerability Response Team
ca technologies Business Unit Operations
wilj...@ca.com
-BEGIN PGP SIGNATURE-
Version: GnuPG v2.0.16 (MingW32)
iEYEARECAAYFAk0eRkEACgkQeSWR3+KUGYVuvQCgkCI+mqnFSazvhzN8anG9dPEu
4GEAoJeHEInf6VzrioKGscIj5J0xq+Mb
=XuTb
-END PGP SIGNATURE-
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
