Multiple Critical Vulnerabilities in Arcserve UDP

Proof-of-concept have been released for three critical vulnerabilities

Threat ID:: CC-4417
Threat Severity:: Medium
Published:: 7 December 2023 12:46 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Proof-of-concept have been released for three critical vulnerabilities

Affected platforms

The following platforms are known to be affected:

Versions: All prior to 9.2

Arcserve Unified Data Protection (UDP)

Threat details

Introduction

ArcServe, a data protection, replication and recovery solutions provider have released a security advisory addressing three critical vulnerabilities affecting Arcserve Unified Data Protection (UDP).

Vulnerability details

CVE-2023-41998 - CWE-94 - Improper Control of Generation of Code ('Code Injection')

This is a remote code execution (RCE) vulnerability, with a CVSS score of 9.8, which could allow a remote, unauthenticated attacker to perform remote code execution.

CVE-2023-41999 - CWE-287 - Improper Authentication

This is an authentication bypass vulnerability, with a CVSS score of 9.8, which could allow a remote, unauthenticated attacker to log in to the console and obtain user credentials.

CVE-2023-42000 - CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

This path traversal vulnerability, with a CVSS score of 9.8, which could allow a remote, unauthenticated attacker to upload arbitrary files to any location on the file system where the UDP agent is installed.

Proof-of-concept available

Proof-of-concept exploit code is available for CVE-2023-41998, CVE-2023-41999 and CVE-2023-42000.

Remediation advice

Affected organisations are encouraged to review the Arcserve UDP Security Fix update - P00002983 and apply any relevant updates.

Definitive source of threat updates

support.arcserve.com/s/article/P00002983?language=en_US

CVE Vulnerabilities

Status Published

CVE-2023-41998

Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacker to upload and execute arbitrary files.

Status Published

CVE-2023-41999

An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that allows them to authenticate to the management console and perform tasks that require authentication.

Status Published

CVE-2023-42000

Arcserve UDP prior to 9.2 contains a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload(). An unauthenticated remote attacker can exploit it to upload arbitrary files to any location on the file system where the UDP agent is installed.

Last edited: 8 December 2023 1:55 pm