RCE in Computer Associates Arcserve Backup Laptops And Desktops
CVE-2008-1786
The DSM gui_cm_ctrls ActiveX control (gui_cm_ctrls.ocx), as used in multiple CA products including BrightStor ARCServe Backup for Laptops and Desktops r11.5, Desktop Management Suite r11.1 through r11.2 C2; Unicenter r11.1 through r11.2 C2; and Desktop and Server Management r11.1 through r11.2 C2 allows remote attackers to execute arbitrary code via crafted function arguments.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.068 (93.6th percentile) — read the EPSS interpretation.
Affected products
- Computer_associates Arcserve_backup_laptops_and_desktops — versions r11.5
- Computer_associates Desktop_and_server_management — versions r11.1, r11.2, r11.2a
- Computer_associates Desktop_management_suite — versions r11.2, r11.2a, r11.2c1
- Computer_associates Unicenter_asset_management — versions r11.1, r11.2, r11.2a
- Computer_associates Unicenter_desktop_management_bundle — versions r11.1, r11.2, r11.2a
- Computer_associates Unicenter_remote_control — versions r11.1, r11.2, r11.2a
- Computer_associates Unicenter_software_delivery — versions r11.1, r11.2, r11.2a
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)