Broadcom Arcserve Backup vulnerabilities

12 CVEs affecting Broadcom Arcserve Backup, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-1662, published 2012-03-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-4397, published 2008-10-14. High severity, CVSS 10.0. EPSS: 80.5% chance of exploitation in the next 30 days. Directory traversal vulnerability in the RPC interface (asdbapi.dll) in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to execute arbitrary…
CVE-2008-5415, published 2008-12-11. High severity, CVSS 10.0. EPSS: 8.3% chance of exploitation in the next 30 days. The LDBserver service in the server in CA ARCserve Backup 11.1 through 12.0 on Windows allows remote attackers to execute arbitrary code via a handle_t argument to an RPC endpoint in which the…
CVE-2008-4399, published 2008-10-14. Medium severity, CVSS 5.0. EPSS: 8.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the database engine service in asdbapi.dll in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to cause a denial of…
CVE-2008-4398, published 2008-10-14. Medium severity, CVSS 5.0. EPSS: 8.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the tape engine service in asdbapi.dll in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to cause a denial of…
CVE-2008-4400, published 2008-10-14. Medium severity, CVSS 5.0. EPSS: 3.4% chance of exploitation in the next 30 days. Unspecified vulnerability in asdbapi.dll in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to cause a denial of service (crash of multiple…
CVE-2001-0960, published 2001-09-15. High severity, CVSS 10.0. EPSS: 3.4% chance of exploitation in the next 30 days. Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 stores the backup agent user name and password in cleartext in the aremote.dmp file in the ARCSERVE$ hidden share, which allows…
CVE-2001-0959, published 2001-09-15. Medium severity, CVSS 6.4. EPSS: 3% chance of exploitation in the next 30 days. Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 creates a hidden share named ARCSERVE$, which allows remote attackers to obtain sensitive information and overwrite critical files.
CVE-2009-3588, published 2009-10-13. Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust…
CVE-2012-1662, published 2012-03-22. Medium severity, CVSS 5.0. EPSS: 2.2% chance of exploitation in the next 30 days. CA ARCserve Backup r12.0 through SP2, r12.5 before SP2, r15 through SP1, and r16 before SP1 on Windows allows remote attackers to cause a denial of service (service shutdown) via a crafted network…
CVE-1999-1049, published 1999-02-21. High severity, CVSS 10.0. EPSS: 1.7% chance of exploitation in the next 30 days. ARCserve NT agents use weak encryption (XOR) for passwords, which allows remote attackers to sniff the authentication request to port 6050 and decrypt the password.

Latest

CVE-2001-1346, published 2001-05-18. Low severity, CVSS 1.2. EPSS: 0.6% chance of exploitation in the next 30 days. Computer Associates ARCserveIT 6.61 and 6.63 (also called ARCservIT) allows local users to overwrite arbitrary files via a symlink attack on the temporary files (1) asagent.tmp or (2) inetd.tmp.