Criminals target CA's BrightStor in new attack

Top Stories

Related

• Clues point to Jan. 13 release of Windows 7 beta
• Microsoft releases Vista SP2 beta
• Obama's DHS pick may find support for raising H-1B cap at confirmation hearing
• IBM wants info from Apple execs in Papermaster case
• License server glitch exposes SonicWall users to e-mail security threats
• Report: Former AOL chief exec tries to raise funds to buy Yahoo

• Global News Update: Monday, November 24, 2008
• Symantec sees spike in dangerous Microsoft attacks
• New worm exploits critical Windows bug
• Gimmiv worm feeds on latest Microsoft bug
• News Briefs

Zone

The Security Zone With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. Having the right policies, procedures and server configurations is critical... Learn more in The Security Zone See All Zones

March 25, 2008 (IDG News Service) Just days after Microsoft Corp. warned of attacks targeting its Jet Database Engine software, cybercriminals have found a new program to attack: CA's BrightStor ARCserve Backup for Laptops and Desktops.

The new attack was reported Monday by Symantec, which said that a malicious Web page with a .cn domain was serving the attack code. By tricking an ARCserve user into visiting the Web site in question, attackers could leverage the flaw to install malicious software on a victim's PC, Symantec said.

A proof-of-concept example of the code was made public last week on the Milw0rm.com Web site. Symantec quickly predicted that it would likely be modified and used for attack.

The flaw lies in the Unicenter DSM r11 List Control ATX ActiveX control, found in ARCserve Backup for Laptops and Desktops version 11.5, Symantec said. Other versions of the product may also be vulnerable, however.

CA has not commented on the bug, so there is no indication when it might be patched.

Symantec is advising users to turn off the buggy ActiveX control within the Windows Registry, something that should only be attempted by technically savvy users.

"Until a patch is available, we urge users to set the kill bit on the affected CLSID [Class identifier] for workstation or terminal server computers that have this software installed," Symantec said in an alert sent out Monday to users of the company's DeepSight threat management system. The CLSID for the CA control is BF6EFFF3-4558-4C4C- ADAF-A87891C5F3A3. Symantec said.

It's not the only vulnerability that system administrators are worrying about this month.

On March 3, Panda Security reported that a flaw in the Jet Database Engine software that ships with Windows was being exploited by attackers who were distributing malicious .mdb (Microsoft Access Database) files in public forums.

Late Friday, Microsoft issued an advisory on the issue, saying that it could affect Word users, and possibly users of other Microsoft products as well. According to Symantec, Microsoft's advisory relates to the same malware that Panda had spotted.

Microsoft has not said when it intends to patch this bug, but has not ruled out the possibility of an emergency patch.

Reprinted with permission from

IDG.net
Story copyright 2008 International Data Group. All rights reserved.