CA backup bug exploitable on Vista |
 |
By Michael S. Mimoso, Editor, Information Security magazine
06 Feb 2007 | Information Security magazine |
|
|
SAN FRANCISCO -- Core Security Technologies Inc. announced today that it has found a working exploit for a previously patched vulnerability in CA's BrightStor ARCserve Backup for Microsoft's Windows Vista operating system.
The announcement, made today at RSA Conference 2007, came immediately following the opening keynote by Microsoft Chairman Bill Gates.
Core Security director of product management Max Caceres told Information Security this is the first exploit for a third-party app running on Vista.
CA Inc. reported Jan. 11 multiple buffer overflow vulnerabilities in versions 9.01 through 11.5 of its backup software. A patch was immediately available for the flaw, which could enable an attacker to remotely compromise and control a Vista server hosting the CA software.
CA said in a release that it has not specified that its customers use those versions with Vista. The vendor also said that its first general release of BrightStor ARCserve Backup for Vista (r11.5 SP3), due in a few weeks, will include a patch for the vulnerability.
The discovery seems to suggest that third parties -- in a rush to market software compatible with Vista -- may not be taking advantage of some of the new operating system's security features. Microsoft has said Vista is its most secure OS to date, and features like Address Space Layout Randomization (ASLR) are meant to harden Vista from malware attacks.
"Vendors have to add this code to their applications," Caceres said. "When Microsoft has a new OS, ISVs want to say their software runs on the new OS. The standard thing is to port the application to do that, and in subsequent releases, catch up to take advantage of the new features."
Additional coding can be substantial for an ISV, Caceres said.
"One of the key features that Vista provides is backwards compatibility; you'll have apps that just happen to work on Vista, which means the transition will be easier for customers who want to install it. But it's important for those customers not to get a false sense of security, believing they've installed Vista and all of the security features have been applied to third-party applications."
Enterprises should press third-party vendors and understand exactly what they mean when they say their products run on Vista.
"This highlights the need to continually test the security of a network," Caceres said. "Just because there's a better version of the OS doesn't mean all of the apps have taken advantage of the new security features."
<< Return to our special coverage of RSA Conference 2007
|
