CVE:CVE-2007-5331
CNNVD:CNNVD-200710-264
BrightStor ARCserve Backup可为各种平台的服务器提供备份和恢复保护功能。
BrightStor ARCserve Backup的队列服务实现上存在漏洞，远程攻击者可能利用此漏洞控制服务器。
如果向BrightStor的ARCserve Backup消息队列服务LQserver.exe发送了畸形的ONRPC协议请求的话，就会在Queue.dll中触发内存破坏。仅可以通过调用0x0006097d进程ID(LQserver.exe的特定Proc ID)下的0x76(数据队列请求)操作才可以触发这个漏洞。在初始化这个过程后，LQServer.exe就会调用有漏洞的DLL文件Queue.dll，这个过程未经任何验证便处理了用户数据并引用为变量，如下所示：
<lqserver.exe>
100161B0     MOV EDX,DWORD PTR DS:[ECX+4]    ; Move Arbitrary Pointer #2 into EDX
100161B3     PUSH EDX            ; Push Arbitrary Pointer #2 onto the Stack
100161B4     MOV EAX,DWORD PTR SS:[EBP+8]    ; Move (0x0113F8A8 the address to Arbitrary
                        ; Pointer #1) into EAX
100161B7     MOV ECX,DWORD PTR DS:[EAX]    ; Move Arbitrary Pointer #1 into ECX
100161B9     PUSH ECX            ; Push Arbitrary Pointer #1 onto the Stack
100161BA     CALL QUEUE.10012816        ; CALL Vulnerable DLL
...
<queue.dll>
1001281C     CMP DWORD PTR SS:[EBP+8],0    ; EBP + 8 points to Arbitrary Pointer #1  - This makes 
                        ; sure our pointer isn t NULL.
10012820     JNZ SHORT QUEUE.10012829    ; Since our pointer isn t NULL we jump
10012829     MOV EAX,DWORD PTR SS:[EBP+8]    ; Load Arbitrary Pointer #1 into EAX
1001282C       MOV DWORD PTR SS:[EBP-4],EAX    ; Write Arbitrary Pointer into EBP-4 (0x00D39618)
1001282F       CMP DWORD PTR DS:[10037884],0    ; This checks for an error message field - NULL 
                        ; signifies  The operation completed successfully 
10012836       JE SHORT QUEUE.10012870        ; Jump is taken
10012870      MOV EAX,DWORD PTR SS:[EBP+C]    ; Move Arbitrary Pointer #2 into EAX
10012873    PUSH EAX            ; Push Arbitrary Pointer #2 onto the stack
10012874       PUSH QUEUE.10037884        ; Push NULL
10012879       MOV ECX,DWORD PTR SS:[EBP-4]    ; Move Arbitrary Pointer #1 into ECX
1001287C       MOV EDX,DWORD PTR DS:[ECX]    ; Move Arbitrary Pointer #1 into EDX
1001287E      MOV ECX,DWORD PTR SS:[EBP-4]    ; Move Arbitrary Pointer #1 into ECX
10012881      CALL DWORD PTR DS:[EDX]        ; Call Arbitrary Pointer #1
这时Queue.dll引用并调用了Arbitrary Pointer #1，然后会调用Arbitrary Pointer #2。在调用Arbitrary Pointer #2后，攻击者就可以完全控制代码的执行并重新定向Queue.dll执行任意代码。攻击完成后，LQserver.exe会崩溃，必须通过CA Domain Server服务手工重启。
solution:Upgrade broadcom brightstor_arcserve_backup to a higher version than 9.01,11.1,11.5,and avoid the version 9.01,11.1,11.5; Upgrade broadcom brightstor_enterprise_backup to a higher version than 10.5,and avoid the version 10.5; Upgrade broadcom business_protection_suite to a higher version than 2.0,and avoid the version 2.0; Upgrade broadcom server_protection_suite to a higher version than 2,and avoid the version 2; Upgrade ca brightstor_arcserve_backup to a higher version than 11,and avoid the version 11; Upgrade ca business_protection_suite to a higher version than 2.0,and avoid the version 2.0