CVE-2006-5143: CA BrightStor ARCserve Backup RPC services buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution across multiple services on backup infrastructure, combined with a very high EPSS score and public exploit-related advisories, makes this an urgent patching priority.

What it is

Multiple buffer overflows exist in CA BrightStor ARCserve Backup and related products, affecting the Backup Agent RPC Server, Message Engine RPC Server, Discovery Service, and Job Engine Service. Crafted data sent to several TCP ports can overflow buffers and allow remote code execution, making this a serious pre-authentication risk for exposed backup infrastructure.

Impact

A remote attacker can execute arbitrary code with the privileges of the affected services, which typically run with high system rights on backup servers. This can lead to full compromise of the backup host and any data or credentials it manages.

Attack surface

The flaws are reachable over the network via TCP ports 6071, 6503, and 41523, plus unspecified vectors in the Job Engine Service. The CVSS vector AV:N/AC:L/Au:N indicates no authentication is required and no user interaction is needed.

Exploitation

The record is not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.795 (99.6th percentile), and multiple public advisories and ZDI reports exist, indicating significant exploitation likelihood.

What to do

• Apply the vendor patch referenced in the CA support notice and TippingPoint/ZDI advisories, upgrading to a fixed BrightStor ARCserve Backup release.
• Restrict network access to TCP ports 6071, 6503, and 41523 so only trusted management hosts can reach the backup services.
• Segment backup servers from general user networks and the internet, and block these ports at perimeter and internal firewalls.
• Retire or isolate end-of-life versions such as r11.5 SP1, r11.1, 9.01, and Enterprise Backup 10.5 that no longer receive vendor support.
• Monitor and limit access to the Job Engine Service and other RPC endpoints to trusted administrative subnets.

Detection

• Monitor network traffic to TCP ports 6071, 6503, and 41523 for anomalous or oversized RPC payloads and unexpected source addresses.
• Alert on crashes or restarts of DBASVR.exe, msgeng.exe, casdscsvc.exe, and Job Engine Service processes, which may indicate exploitation attempts.
• Review service and application logs for malformed RPC opcodes such as 0x01, 0x02, 0x18, 0x2b, and 0x2d, and for unusually long hostname values reaching the Discovery Service.
• Use IDS/IPS signatures for known BrightStor ARCserve RPC overflow attempts and correlate with outbound connections from backup servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.