CVE:CVE-2007-5004
CNNVD:CNNVD-200710-003
ARCServe Backup for Laptops and Desktops (L&D)是适用于中小业务的ARCServe Backup备份工具版本。
认证口令整数溢出rxRPC.dll的认证部分存在栈溢出漏洞。带有无效口令的合法认证请求示例如下：
1: 0000000030rxrLogin~~administrator~~18
2: 000000000000000000
加密的无效口令可能导致可利用的情况：
    .text: 00231F24        mov    cl, [esi+8]
    .text: 00231F27        and    ecx, 0x0F
    .text: 00231F2A        add    esp, 8
    .text: 00231F2D        dec    ecx    ; XXXX Integer Overflow If ECX = 0
    .text: 00231F2E        mov    [esp+0x7C+var_6C], eax
    .text: 00231F32        mov    dwPasswordCopyLength, ecx
    .text: 00231F38        mov    eax, ecx
    .text: 00231F3A        lea    esi, [esp+0x7C+var_6C]
    .text: 00231F3E        mov    edi, ebx
    .text: 00231F40        shr    ecx, 2
    .text: 00231F43        rep movs     ; XXXX EXCEPTION: HITS PAGE BOUNDARY XXXX
源缓冲区中的数据包含有大量不可控的数据，但还存在用户名的拷贝，因此如果在原始报文中指定了超长用户名的话就会覆盖异常处理器。
solution:Upgrade broadcom brightstor_arcserve_backup_laptops_desktops to a higher version than 4.0,11.0,11.1,11.1:sp1,11.5,and avoid the version 4.0,11.0,11.1,11.1:sp1,11.5; Upgrade broadcom desktop_management_suite to a higher version than 11.0,11.1,11.2,and avoid the version 11.0,11.1,11.2; Upgrade ca protection_suites to a higher version than r2,and avoid the version r2