CVE-2006-5143 in BrightStor ARCserve Backup
Summary
by MITRE
Multiple buffer overflows in CA BrightStor ARCserve Backup r11.5 SP1 and earlier, r11.1, and 9.01; BrightStor ARCserve Backup for Windows r11; BrightStor Enterprise Backup 10.5; Server Protection Suite r2; and Business Protection Suite r2 allow remote attackers to execute arbitrary code via crafted data on TCP port 6071 to the Backup Agent RPC Server (DBASVR.exe) using the RPC routines with opcode (1) 0x01, (2) 0x02, or (3) 0x18; invalid stub data on TCP port 6503 to the RPC routines with opcode (4) 0x2b or (5) 0x2d in ASCORE.dll in the Message Engine RPC Server (msgeng.exe); (6) a long hostname on TCP port 41523 to ASBRDCST.DLL in the Discovery Service (casdscsvc.exe); or unspecified vectors related to the (7) Job Engine Service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/23/2026
The vulnerability described in CVE-2006-5143 represents a critical buffer overflow issue affecting multiple components of CA BrightStor ARCserve Backup software across several versions and products. This vulnerability resides within the RPC server implementations that handle various backup operations and network communications. The affected systems include BrightStor ARCserve Backup r11.5 SP1 and earlier versions, r11.1, 9.01, Windows r11, BrightStor Enterprise Backup 10.5, Server Protection Suite r2, and Business Protection Suite r2, creating an extensive attack surface for potential exploitation.
The technical flaw manifests through multiple attack vectors that exploit buffer overflow conditions in different RPC server components. The primary exploitation occurs through TCP port 6071 where the DBASVR.exe process handles RPC routines with opcodes 0x01, 0x02, and 0x18, allowing attackers to send crafted data that overflows buffers and potentially executes arbitrary code. Additionally, TCP port 6503 presents another attack vector through the Message Engine RPC server (msgeng.exe) where invalid stub data can be sent to ASCORE.dll using opcodes 0x2b or 0x2d. The vulnerability also extends to TCP port 41523 where ASBRDCST.DLL in the Discovery Service (casdscsvc.exe) accepts overly long hostnames that trigger buffer overflows. These multiple entry points demonstrate the widespread nature of the vulnerability across different service components.
The operational impact of this vulnerability is severe as it allows remote attackers to execute arbitrary code on vulnerable systems without requiring authentication. This represents a critical security risk for backup infrastructure, as these systems often contain sensitive organizational data and operate with elevated privileges. The buffer overflow conditions can lead to complete system compromise, allowing attackers to gain unauthorized access, escalate privileges, or disrupt backup operations. The vulnerability affects enterprise backup environments where these systems are typically exposed to network traffic and may serve as targets for lateral movement within networks. The remote execution capability eliminates the need for physical access or local credentials, making the attack vector particularly dangerous for enterprise environments.
The vulnerability aligns with CWE-121 and CWE-122 categories from the Common Weakness Enumeration, which classify buffer overflow conditions and improper restriction of operations within a limited memory buffer. From an ATT&CK framework perspective, this vulnerability maps to techniques involving remote code execution through network services and privilege escalation. The attack pattern follows T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation) tactics. Organizations should implement immediate mitigations including network segmentation to isolate backup servers, firewall rules to restrict access to affected TCP ports, and prompt patching of the affected software versions. Additionally, monitoring for unusual network traffic patterns on the specified ports and implementing intrusion detection systems can help identify potential exploitation attempts. The vulnerability demonstrates the critical importance of maintaining up-to-date security patches for enterprise backup infrastructure, as these systems often represent high-value targets for attackers seeking persistent access to organizational networks.