Title: BrightStor ARCserve/Enterprise Backup Default Backdoor Account Vulnerability
Severity: CRITICAL
Description:
Computer Associates BrightStor ARCserve/Enterprise Backup products provide backup and restore protection for Windows, NetWare, Linux and UNIX servers as well as Windows, Mac OS X, Linux, UNIX, AS/400 and VMS client. BrightStor applications use a network agent called 'UniversalAgent' to perform backups on network nodes. This agent requires administrative credentials or node-specific credentials to perform backups or execute commands on a computer.
BrightStor ARCserve/Enterprise Backup products contain a backdoor account with a username of '\x02root\x03', with a password of '\x02<%j8U]`~+Ri\x03'. It is reported that these hard coded credentials are present in the 'UniversalAgent' service of BrightStor ARCserve/Enterprise Backup products for UNIX platforms.
An attacker may carry out various attacks such as arbitrary command and code execution by using the hard coded credentials. This may lead to a complete compromise of an affected computer.
BrightStor ARCserve/Enterprise Backup products on UNIX computers run as the superuser. This vulnerability is not reported to affect the products on Windows platforms.
Affected Products:
- Computer Associates BrightStor ARCServe Backup for AIX 11.1.0
- Computer Associates BrightStor ARCServe Backup for HP 11.1.0
- Computer Associates BrightStor ARCServe Backup for Linux 11.1.0
- Computer Associates BrightStor ARCServe Backup for Linux 7.0.0
- Computer Associates BrightStor ARCServe Backup for Linux 9.0.0
- Computer Associates BrightStor ARCServe Backup for Linux Japanese 9.0.0
- Computer Associates BrightStor ARCServe Backup for Macintosh 11.1.0
- Computer Associates BrightStor ARCServe Backup for Mainframe Linux 11.1.0
- Computer Associates BrightStor ARCServe Backup for Solaris 11.1.0
- Computer Associates BrightStor ARCServe Backup for Tru64 11.1.0
- Computer Associates BrightStor Enterprise Backup for AIX 10.0.0
- Computer Associates BrightStor Enterprise Backup for AIX 10.5.0
- Computer Associates BrightStor Enterprise Backup for HP 10.5.0
- Computer Associates BrightStor Enterprise Backup for HPUX 10.0.0
- Computer Associates BrightStor Enterprise Backup for Mainframe Linux 10.0.0
- Computer Associates BrightStor Enterprise Backup for Solaris 10.0.0
- Computer Associates BrightStor Enterprise Backup for Solaris 10.5.0
- Computer Associates BrightStor Enterprise Backup for Tru64 10.5.0
References:
- Computer Associates: BrightStor ARCserve Backup Product Page
- iDEFENSE: iDEFENSE Security Advisory 02.10.05: BrightStor ARCserve Backup Backdoor Vuln
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
