Unscored severity · published Oct 14, 2008
CVE-2008-4397
Directory traversal vulnerability in the RPC interface (asdbapi.dll) in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to…
–
CVSS
80.5%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the RPC interface (asdbapi.dll) in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to execute arbitrary commands via a .. (dot dot) in an RPC call with opnum 0x10A.
Exploitation
Is it being used?
Exploit prediction (EPSS)80.5% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Arcserve Backup · Broadcom
r12.0 · source: NVD
BP
Business Protection Suite · Broadcom
r2 · source: NVD
SP
Server Protection Suite · Broadcom
r2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-4397
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-4397
Vendor Advisory
http://secunia.com/advisories/32220
securityreason.com
http://securityreason.com/securityalert/4412
www.securityfocus.com
http://www.securityfocus.com/archive/1/497218
www.securityfocus.com
http://www.securityfocus.com/archive/1/497281/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/31684
www.securitytracker.com
http://www.securitytracker.com/id?1021032
More from Arcserve Backup
–
CVE-2012-1662
CA ARCserve Backup r12.0 through SP2, r12.5 before SP2, r15 through SP1, and r16 before SP1 on Windows allows remote attackers to cause a denial of service (service shutdown) via…
–
CVE-2009-3588
Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8)…
–
CVE-2008-5415
The LDBserver service in the server in CA ARCserve Backup 11.1 through 12.0 on Windows allows remote attackers to execute arbitrary code via a handle_t argument to an RPC endpoint…
–
CVE-2008-4400
Unspecified vulnerability in asdbapi.dll in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to cause a denial of service…
–
CVE-2008-4399
Unspecified vulnerability in the database engine service in asdbapi.dll in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to…