Buffer overflow in Computer Associates Brightstor Arcserve Backup Laptops Desktops
CVE-2008-1472
Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products including BrightStor ARCserve Backup R11.5, Desktop Management Suite r11.1 through r11.2, and Unicenter products r11.1 through r11.2, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long argument to the AddColumn method.
Vulnerability class: Buffer Overflow
EPSS: 0.390 (98.5th percentile) — read the EPSS interpretation.
Affected products
- Computer_associates Brightstor_arcserve_backup_laptops_desktops — versions 11.5
- Computer_associates Desktop_management_suite — versions r11.1, r11.2
- Computer_associates Unicenter_dsm_r11_list_control_atx — versions 11.2.3.1895
- Unicenter Asset_management — versions r11.1, r11.2
- Unicenter Desktop_management_bundle — versions r11.1, r11.2
- Unicenter Remote_control — versions r11.1, r11.2
- Unicenter Software_delivery — versions r11.1, r11.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2008-1472?
- CVE-2008-1472 is a vulnerability in Computer Associates Brightstor Arcserve Backup Laptops Desktops, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2008-03-24.
- Is CVE-2008-1472 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.