SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   CA ARCserve Backup Vendors:   CA
(Patch Available) Re: ARCserveIT Storage Management Discloses Backup Account Password to Remote Users
SecurityTracker Alert ID:  1002420
SecurityTracker URL:  http://securitytracker.com/id/1002420
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 17 2001
Impact:   Disclosure of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): ARCserve for NT, version 6.61 SP2a; also confirmed by another user in ARCserve 2000 Advanced Edition, v. 7.0, build 1050, SP2
Description:   A file sharing vulnerability has been reported in Computer Associates' ARCserveIT for Windows NT. The default installation creates a world-readable file that contains the backup account username and password.

It is reported that the default install of ARCserveIT for Microsoft Windows NT creates a hidden share ('ARCSERVE$') with share permissions that allow all users in a domain to map this share.

The software reportedly creates a file named 'aremote.dmp' within the share (ARCSERVE$\DR\<NAME of SERVER>\aremote.dmp). This file apparently contains the name of the NT account that runs the backup as well as the password for that account.

The vendor has reportedly been notified and will be making a patch available.

Impact:   A remote user can access a shared file that contains the backup account user name and password. This could be the administrator account if the backup is run from the administrator account.
Solution:   A user reports that a patch is available for ARCserveIT 2000 with SP2a:

http://support.ca.com/Download/patches/asitnt/QO00945.html

Vendor URL:  www.ca.com/arcserveit/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Windows (NT)

Message History:   This archive entry is a follow-up to the message listed below.
Sep 17 2001 ARCserveIT Storage Management Discloses Backup Account Password to Remote Users



 Source Message Contents

Subject:  AW: ARCserve 6.61 Share Access Vulnerability


Hi,

the problem also applys to ArcServe 2000. This securityleak was announced by
CA in the Storage-Newsletter september-edition. There is a patch for
ArcServe 2000 with SP2a available from
http://support.ca.com/Download/patches/asitnt/QO00945.html Couldn't find
anything for ArcServe 6.61IT.

Does anybody know why this share is needed? What's with removing the share?
Can the mentioned permissions be used?

Marcus Bednorz


Von: ron [mailto:rdr@steelrat.kernelsutra.com]
Gesendet: Sonntag, 16. September 2001 06:27
An: bugtraq@securityfocus.com
Betreff: ARCserve 6.61 Share Access Vulnerability


I have found a vulnerability with ARCServe for NT 6.61 SP2a. I stumbled upon
this while performing a vulnerability analysis. 

Details:

The default install of ARCServe for NT creates a hidden share on Windows NT
machines when it is installed.

The name of this share is ARCSERVE$.

The permissions of the share allow all users in a domain to map this share.
However, this is not the worst part.

Within the share is a file named aremote.dmp.  The full path is
ARCSERVE$\DR\<NAME of SERVER>\aremote.dmp.

In the aremote.dmp file, the account name that runs the backup is in
cleartext within this file.  Also, a little further
within the file, the password for the account is in cleartext.

Seeing as how the account that performs backups can access system files,
this is very dangerous.  Some places run their
backups as the NT domain administrator account.

Fix:

CA has been notified and will be making a patch available to all customers.


Also, it _should_ be possible to change the share permissions, allowing only
the backup account and the administrator access to the share.


I am not sure if this is in ARCServe 2000 or in releases prior, as I have
not checked them.

- rdr

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC