CVE-2007-2139: Multiple stack-based buffer overflows in the SUN RPC service in CA (formerly Computer Associates) BrightSto...

Security readout for executives and security teams

This is a remote code execution flaw in CA BrightStor ARCserve backup media server components. A malformed SUN RPC request could corrupt memory and let an attacker run code on the backup server. Backup infrastructure often has broad system access, so confirmed exposure should be treated as serious even though the sources do not show active exploitation. Exposure is most likely in legacy environments still running CA BrightStor ARCserve Backup or bundled protection suites from the listed versions. Internet exposure would be especially concerning, but the bundle does not provide port, authentication, or default configuration details. Treat as urgent if any affected legacy backup server still exists, especially on reachable networks. The business concern is attacker control of backup infrastructure, not just a single application crash. Mitigation focus: Identify any CA BrightStor ARCserve Media Server installations.; Check CA or successor vendor guidance for fixed versions or replacements.; Remove unsupported BrightStor systems from production where possible..

Prepared

Jun 29, 2026, 05:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.