CveMateVulnerability intelligence

CVE-2007-0449: broadcom brightstor_arcserve_backup_laptops_desktops

CVSS: 10.0v2.0HighModified

Published 23-01-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-0449 is a high (CVSS 10.0) vulnerability in broadcom brightstor_arcserve_backup_laptops_desktops. EPSS estimates a 79.36% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

79.36%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits5exploit-database, metasploit

Timeline

23-01-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r4.0, Desktop and Business Protection Suite r2, and Desktop Management Suite (DMS) r11.0 and r11.1 allow remote attackers to execute arbitrary code via crafted packets to TCP port (1) 1900 or (2) 2200.

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

79.36%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 79.36% on 19-09-2026

19-09-202619-10-2026

EPSS score

79.36%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found

exploit-databaseremotewindowsVerified
CA BrightStor ARCserve - 'lgserver.exe' Remote Stack Overflow
Maturity: weaponized
exploit-databaseremotewindowsVerified
CA BrightStor ARCserve - 'msgeng.exe' Remote Heap Overflow (1)
Maturity: weaponized
exploit-databaseremotewindowsVerified
CA BrightStor ARCserve - 'msgeng.exe' Remote Heap Overflow (2)
Maturity: weaponized

Show all 5 exploits

exploit-databaseremotewindowsVerified
CA BrightStor ARCserve for Laptops & Desktops LGServer - Remote Buffer Overflow (Metasploit) (1)
Maturity: weaponized
MetasploitremoteUnverified
CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow
exploit/windows/brightstor/lgserver
Maturity: poc

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Broadcom5 products

brightstor_arcserve_backup_laptops_desktops11.0 | 11.1 | 11.1:sp1
brightstor_mobile_backupr4.0
business_protection_suite2.0
desktop_management_suite11.0 | 11.1
desktop_protection_suite2.0

1 vendor · 5 products

References

16 links

www.securityfocus.com/bid/22340VDB EntryX Refsource BID
www3.ca.com/securityadvisor/newsinfo/collateral.aspx?cid=97696X Refsource CONFIRM
www.osvdb.org/31593VDB EntryX Refsource OSVDB
www.kb.cert.org/vuls/id/611276Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.securityfocus.com/archive/1/458648/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/23897Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
www.securityfocus.com/archive/1/458644/100/0/threadedMailing ListX Refsource BUGTRAQ
www3.ca.com/securityadvisor/vulninfo/Vuln.aspx?ID=34993X Refsource CONFIRM
exchange.xforce.ibmcloud.com/vulnerabilities/31704VDB EntryX Refsource XF
www.securityfocus.com/archive/1/457945/30/8460/threadedMailing ListX Refsource BUGTRAQ

Show all 16 references

www.securityfocus.com/bid/22199VDB EntryX Refsource BID
www.securityfocus.com/bid/22342VDB EntryX Refsource BID
www.vupen.com/english/advisories/2007/0314VDB EntryX Refsource VUPENVendor Advisory
www.kb.cert.org/vuls/id/357308Third Party AdvisoryX Refsource CERT VNUS Government Resource
securitytracker.com/id?1017548VDB EntryX Refsource SECTRACK
supportconnectw.ca.com/public/sams/lifeguard/infodocs/babldimpsec-notice.aspX Refsource CONFIRMPatch