IBM’s Internet Security Systems (ISS) X-Force research team has discovered two similar, but distinct vulnerabilities in Brightstor ARCserve, the cross-platform backup and recovery solution from CA.

The vulnerabilities discovered by X-Force can be exploited remotely with no user interaction required. Successful exploitation could grant the attacker administrative privileges on the target machine.

The Big Blue has already taken steps to protect IBM ISS customers using the CA product. By infusing its products and services with security intelligence from X-Force and the IBM Virtual Patch technology, the vendor has designed a solution to protect customers before their business assets are impacted by online intrusions.

"CA Brightstor ARCserve is widely deployed in corporate environments. Since it is normally used for the protection and recovery of mission-critical applications, and since these two vulnerabilities are not difficult to exploit, ISS recommends that companies using CA Brightstor ARCserve patch immediately," said Pete Allor, director of intelligence for IBM Internet Security Systems.

The X-Force security advisories on these vulnerabilities can be found at:
http://www.iss.net/threats/252.html
http://www.iss.net/threats/253.html