CVE-2007-0449
CA BrightStor ARCserve Backup r11.0-r11.1 SP1 - Remote Code Execution via Crafted Packets
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2007-0449.
PoCs published by Metasploit, Winny Thomas, Jacopo Cervini, including Metasploit module exploits/windows/brightstor/lgserver.
AI-analyzed exploit summary This exploit targets a stack buffer overflow in CA BrightStor ARCserve Backup for Laptops & Desktops 11.1 via a crafted TCP request to port 1900. It leverages SEH overwrites to achieve remote code execution on Windows 2000 Pro.
Description
Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r4.0, Desktop and Business Protection Suite r2, and Desktop Management Suite (DMS) r11.0 and r11.1 allow remote attackers to execute arbitrary code via crafted packets to TCP port (1) 1900 or (2) 2200.
Exploits (5)
This exploit targets a stack buffer overflow in CA BrightStor ARCserve Backup for Laptops & Desktops 11.1 via a crafted TCP request to port 1900. It leverages SEH overwrites to achieve remote code execution on Windows 2000 Pro.
This exploit targets a stack overflow vulnerability in CA BrightStor Arcserve (CVE-2007-0449) by sending a maliciously crafted payload to port 1900, triggering a buffer overflow and executing a port-binding shellcode on TCP port 4444.
This exploit targets a buffer overflow vulnerability in BrightStore ARCServer 11.5.4, sending maliciously crafted requests to achieve remote code execution via shellcode injection. It includes multiple return addresses for different Windows versions.
This exploit targets a heap overflow in CA BrightStor's msgeng.exe service (CVE-2007-0449) by sending a maliciously crafted DCERPC request to overwrite the UnhandledExceptionFilter and execute shellcode. It opens a reverse shell on TCP port 4444 and was tested on Windows 2000 SP0.
This Metasploit module exploits a stack buffer overflow in CA BrightStor ARCserve Backup for Laptops & Desktops 11.1 via a crafted TCP request to port 1900. It leverages SEH overwrites to achieve remote code execution on Windows 2000 Pro.