CVE-2007-1785

CA BrightStor ARCserve Backup 11.5 SP2 build 4237 - RCE

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-1785. PoCs published by Shirkdog.

AI-analyzed exploit summary This exploit targets a design error in Computer Associates BrightStor Backup Mediasvr.exe, leveraging an RPC handling vulnerability to achieve remote code execution. It constructs two RPC packets with embedded shellcode to trigger the vulnerability under different memory conditions (pre- and post-reboot).

Description

The RPC service in mediasvr.exe in CA BrightStor ARCserve Backup 11.5 SP2 build 4237 allows remote attackers to execute arbitrary code via crafted xdr_handle_t data in RPC packets, which is used in calculating an address for a function call, as demonstrated using the 191 (0xbf) RPC request.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Shirkdog · pythonremotewindows

https://www.exploit-db.com/exploits/3604

View Code ZIP pw:eip

This exploit targets a design error in Computer Associates BrightStor Backup Mediasvr.exe, leveraging an RPC handling vulnerability to achieve remote code execution. It constructs two RPC packets with embedded shellcode to trigger the vulnerability under different memory conditions (pre- and post-reboot).

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Computer Associates BrightStor Backup 11.5.2.0 (SP2)

No auth needed

Prerequisites: Network access to the target system · Mediasvr.exe service running on the target

MITRE ATT&CK