CA's BrightStor new attack target
Criminals home in on software vulnerability.
By Robert McMillan, IDG News Service | Published: 07:55, 25 March 2008
Criminals have launched an attack on CA's BrightStor ARCserve Backup.
The assault on the software was reported by Symantec, which said that a malicious web page with a .cn domain was serving the attack code. By tricking an ARCserve user into visiting the website in question, attackers could leverage the flaw to install malicious software on a victim's PC, Symantec said.
A proof-of-concept example of the code was made public last week on the Milw0rm.com website. Symantec quickly predicted that it would likely be modified and used for attack.
The flaw lies in the Unicenter DSM r11 List Control ATX ActiveX control, found in ARCserve Backup version 11.5, Symantec said. Other versions of the product may also be vulnerable, however.
CA has not commented on the bug, so there is no indication when it might be patched.
Symantec is advising users to turn off the buggy ActiveX control within the Windows Registry, something that should only be attempted by technically savvy users.
"Until a patch is available, we urge users to set the kill bit on the affected CLSID [Class identifier] for workstation or terminal server computers that have this software installed," Symantec said in an alert to users of the company's DeepSight threat management system. The CLSID for the CA control is BF6EFFF3-4558-4C4C-ADAF-A87891C5F3A3. Symantec said.
It's not the only vulnerability that system administrators are worrying about this month.
On 3 March, Panda Security reported that a flaw in the Jet Database Engine software that ships with Windows was being exploited by attackers who were distributing malicious .mdb (Microsoft Access Database) files in public forums.
And just a few days ago, Microsoft said the problem could also affect Word users, and possibly users of other Microsoft products as well. According to Symantec, Microsoft's advisory relates to the same malware that Panda had spotted.
Microsoft has not said when it intends to patch this bug, but has not ruled out the possibility of an emergency patch.
