CVE-2006-6076

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 72.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-11-24 · updated 2026-06-16

Description

Buffer overflow in the Tape Engine (tapeeng.exe) in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to execute arbitrary code via certain RPC requests to TCP port 6502.

Affected products

Broadcom Brightstor Arcserve Backup: through 11.5; 11.1, 11.5-sp1
Ca Brightstor Arcserve Backup: 11, 11.1
Ca Brightstor Arcserve Backup Agent: 11.0, 11.1

References

http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050808.html
http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050814.html
http://secunia.com/advisories/23060
http://secunia.com/advisories/24512
http://securitytracker.com/id?1017268
http://supportconnectw.ca.com/public/storage/infodocs/babtapeng-securitynotice.asp
http://www.kb.cert.org/vuls/id/437300
http://www.securityfocus.com/archive/1/452222/100/0/threaded
http://www.securityfocus.com/archive/1/452318/100/0/threaded
http://www.securityfocus.com/archive/1/456711
http://www.securityfocus.com/bid/21221
http://www.vupen.com/english/advisories/2006/4654

Get alerted when CVE-2006-6076 or the next vulnerability affects your stack