Critical · published August 28, 2025
🚨 A heap-based buffer overflow in Arcserve Unified Data Protection could let attackers remotely execute code and take over your system — no authentication needed! 🔥 Think of this vulnerability like a hotel with poorly checked guest IDs. A crafty individual could sneak in with a fake ID, bypassing security checks and wreaking havoc in the building — just like an attacker sending harmful data can corrupt heap memory. If exploited, this could lead to a denial of service, leaving your system paralyzed, or worse, it could enable an attacker to run their own malicious code! Imagine the chaos if unauthorized guests could access your most confidential areas.
Think of this vulnerability like a hotel with poorly checked guest IDs. A crafty individual could sneak in with a fake ID, bypassing security checks and wreaking havoc in the building — just like an attacker sending harmful data can corrupt heap memory. The flaw exists in the input handling routines of UDP, where improper bounds checking allows a remote attacker to send specially crafted data to corrupt heap memory, and potentially execute arbitrary code depending on memory layout.
If exploited, this could lead to a denial of service, leaving your system paralyzed, or worse, it could enable an attacker to run their own malicious code! Imagine the chaos if unauthorized guests could access your most confidential areas. To protect your systems, upgrade to Arcserve UDP version 10.2 immediately! If you're using versions 8.0 through 10.1, make sure to apply the relevant patches or upgrade. Be aware that versions 7.x and earlier are unsupported, so upgrading to 10.2 is a must! You've got this! With these steps, you'll be securing your systems in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| arcserve/udp | < 7.0 | 7.0 |
| arcserve/udp | ≥ 8.0, < 10.2 | 10.2 |
| arcserve/udp | all versions | — |
| arcserve/udp | all versions | — |
| arcserve/udp | all versions | — |