SHELLCODE: Decoder Loop 1 (TCP-STC)
This signature detects a known malicious shellcode decoder. Decoders are used to hide malicious shellcode from detection.
Extended Description
Multiple buffer overflows in CA BrightStor ARCserve Backup r11.5 SP1 and earlier, r11.1, and 9.01; BrightStor ARCserve Backup for Windows r11; BrightStor Enterprise Backup 10.5; Server Protection Suite r2; and Business Protection Suite r2 allow remote attackers to execute arbitrary code via crafted data on TCP port 6071 to the Backup Agent RPC Server (DBASVR.exe) using the RPC routines with opcode (1) 0x01, (2) 0x02, or (3) 0x18; invalid stub data on TCP port 6503 to the RPC routines with opcode (4) 0x2b or (5) 0x2d in ASCORE.dll in the Message Engine RPC Server (msgeng.exe); (6) a long hostname on TCP port 41523 to ASBRDCST.DLL in the Discovery Service (casdscsvc.exe); or unspecified vectors related to the (7) Job Engine Service.
Affected Products
Broadcom server_protection_suite
Short Name
SHELLCODE:ACTIVE:DCDR-1-TCP-STC
Severity
Critical
Recommended
False
Recommended Action
Drop
Category
SHELLCODE
Keywords
(TCP-STC) 1 CVE-2006-5143 CVE-2008-2703 Decoder Loop bid:20364 bid:29602
Release Date
09/25/2013
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3700
Port
TCP/1-24,26-79,81-134,136-442,444,446-65535
False Positive
Unknown
Vendors
Ca
Broadcom