Criminals Target CA's BrightStor in New Attack

Just days after Microsoft warned of attacks targeting its Jet Database Engine software, cybercriminals have found a new program to attack: CA's BrightStor ARCserve Backup for Laptops and Desktops.

The new attack was reported Monday by Symantec, which said that a malicious Web page with a .cn domain was serving the attack code. By tricking an ARCserve user into visiting the Web site in question, attackers could leverage the flaw to install malicious software on a victim's PC, Symantec said.

A proof-of-concept example of the code was made public last week on the Milw0rm.com Web site. Symantec quickly predicted that it would likely be modified and used for attack.

The flaw lies in the Unicenter DSM r11 List Control ATX ActiveX control, found in ARCserve Backup for Laptops and Desktops version 11.5, Symantec said. Other versions of the product may also be vulnerable, however.

CA has not commented on the bug, so there is no indication when it might be patched.

Turn Off ActiveX Control

Symantec is advising users to turn off the buggy ActiveX control within the Windows Registry, something that should only be attempted by technically savvy users.

"Until a patch is available, we urge users to set the kill bit on the affected CLSID [Class identifier] for workstation or terminal server computers that have this software installed," Symantec said in an alert sent out Monday to users of the company's DeepSight threat management system. The CLSID for the CA control is BF6EFFF3-4558-4C4C-ADAF-A87891C5F3A3. Symantec said.

It's not the only vulnerability that system administrators are worrying about this month.

On March 3, Panda Security reported that a flaw in the Jet Database Engine software that ships with Windows was being exploited by attackers who were distributing malicious .mdb (Microsoft Access Database) files in public forums.

Late Friday, Microsoft issued an advisory on the issue, saying that it could affect Word users, and possibly users of other Microsoft products as well. According to Symantec, Microsoft's advisory relates to the same malware that Panda had spotted.

Microsoft has not said when it intends to patch this bug, but has not ruled out the possibility of an emergency patch.