Arcserve Unified Data Protection Heap-Based Buffer Overflow Vulnerability Allowing Pre-Authentication Remote Code Execution

A heap-based buffer overflow vulnerability has been identified in Arcserve Unified Data Protection (UDP) input parsing logic. This vulnerability, present in all UDP versions prior to 10.2, can be exploited without authentication by sending specially crafted input to the target system. The flaw arises from improper bounds checking, allowing attackers to overwrite heap memory, which could lead to application crashes or remote code execution. Exploitation occurs in the context of the affected process and does not require user interaction, posing a high risk of full compromise.

Impact

Successful exploitation of this vulnerability allows for arbitrary code execution in the context of the affected process.

Remediation

Users can upgrade to Arcserve UDP 10.2, which includes the necessary patches. For those using versions 8.0 through 10.1, patches are available. Customers on unsupported versions (UDP 7.x and earlier) should upgrade to UDP 10.2.