PatchTheCVECVE-2008-1472: Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products in
62
This week
HIGH 9.3DOWNGRADEDOWNGRADEDOWNGRADE
CVE-2008-1472 is a high-severity flaw (CVSS 9.3) affecting brightstor arcserve backup laptops desktops, desktop management suite, unicenter dsm r11 list control atx. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products including BrightStor ARCserve Backup R11.5, Desktop Management Suite r11.1 through r11.2, and Unicenter products r11.1 through r11.2, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long argument to the AddColumn method.
Why this priority
- Critical severity
- EPSS top 1%: very likely to be exploited
- Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.3 (High) |
| EPSS exploit chance | 40.3% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-119 |
| Published | 2008-03-24 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
computer associates brightstor arcserve backup laptops desktops DOWNGRADE
Affected: 11.5
Fixed in: no fixed release known
Safe to downgrade to: a release before 11.5
1. Check installed version
apt-cache policy brightstor-arcserve-backup-laptops-desktops || rpm -q brightstor-arcserve-backup-laptops-desktops || brightstor-arcserve-backup-laptops-desktops --version
2. No fixed release: DOWNGRADE to a release before 11.5 (Debian / Ubuntu)
apt-cache madison brightstor-arcserve-backup-laptops-desktops
sudo apt install brightstor-arcserve-backup-laptops-desktops=<VERSION_BEFORE_11.5>
sudo apt-mark hold brightstor-arcserve-backup-laptops-desktops
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list brightstor-arcserve-backup-laptops-desktops
sudo dnf downgrade brightstor-arcserve-backup-laptops-desktops-<VERSION_BEFORE_11.5>
sudo dnf versionlock add brightstor-arcserve-backup-laptops-desktops
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
computer associates desktop management suite DOWNGRADE
Affected: r11.1 a · r11.1 c1 · r11.1 ga · r11.2
Fixed in: no fixed release known
Safe to downgrade to: a release before r11.1
1. Check installed version
apt-cache policy desktop-management-suite || rpm -q desktop-management-suite || desktop-management-suite --version
2. No fixed release: DOWNGRADE to a release before r11.1 (Debian / Ubuntu)
apt-cache madison desktop-management-suite
sudo apt install desktop-management-suite=<VERSION_BEFORE_r11.1>
sudo apt-mark hold desktop-management-suite
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list desktop-management-suite
sudo dnf downgrade desktop-management-suite-<VERSION_BEFORE_r11.1>
sudo dnf versionlock add desktop-management-suite
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
computer associates unicenter dsm r11 list control atx DOWNGRADE
Affected: 11.2.3.1895
Fixed in: no fixed release known
Safe to downgrade to: a release before 11.2.3.1895
1. Check installed version
apt-cache policy unicenter-dsm-r11-list-control-atx || rpm -q unicenter-dsm-r11-list-control-atx || unicenter-dsm-r11-list-control-atx --version
2. No fixed release: DOWNGRADE to a release before 11.2.3.1895 (Debian / Ubuntu)
apt-cache madison unicenter-dsm-r11-list-control-atx
sudo apt install unicenter-dsm-r11-list-control-atx=<VERSION_BEFORE_11.2.3.1895>
sudo apt-mark hold unicenter-dsm-r11-list-control-atx
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list unicenter-dsm-r11-list-control-atx
sudo dnf downgrade unicenter-dsm-r11-list-control-atx-<VERSION_BEFORE_11.2.3.1895>
sudo dnf versionlock add unicenter-dsm-r11-list-control-atx
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
unicenter asset management DOWNGRADE
Affected: r11.1 a · r11.1 c1 · r11.1 ga · r11.2 · r11.2 a · r11.2 c1
Fixed in: no fixed release known
Safe to downgrade to: a release before r11.1
1. Check installed version
apt-cache policy asset-management || rpm -q asset-management || asset-management --version
2. No fixed release: DOWNGRADE to a release before r11.1 (Debian / Ubuntu)
apt-cache madison asset-management
sudo apt install asset-management=<VERSION_BEFORE_r11.1>
sudo apt-mark hold asset-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list asset-management
sudo dnf downgrade asset-management-<VERSION_BEFORE_r11.1>
sudo dnf versionlock add asset-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
unicenter desktop management bundle DOWNGRADE
Affected: r11.1 a · r11.1 c1 · r11.1 ga · r11.2 · r11.2 a · r11.2 c1
Fixed in: no fixed release known
Safe to downgrade to: a release before r11.1
1. Check installed version
apt-cache policy desktop-management-bundle || rpm -q desktop-management-bundle || desktop-management-bundle --version
2. No fixed release: DOWNGRADE to a release before r11.1 (Debian / Ubuntu)
apt-cache madison desktop-management-bundle
sudo apt install desktop-management-bundle=<VERSION_BEFORE_r11.1>
sudo apt-mark hold desktop-management-bundle
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list desktop-management-bundle
sudo dnf downgrade desktop-management-bundle-<VERSION_BEFORE_r11.1>
sudo dnf versionlock add desktop-management-bundle
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
unicenter remote control DOWNGRADE
Affected: r11.1 a · r11.1 c1 · r11.1 ga · r11.2 · r11.2 a · r11.2 c1
Fixed in: no fixed release known
Safe to downgrade to: a release before r11.1
1. Check installed version
apt-cache policy remote-control || rpm -q remote-control || remote-control --version
2. No fixed release: DOWNGRADE to a release before r11.1 (Debian / Ubuntu)
apt-cache madison remote-control
sudo apt install remote-control=<VERSION_BEFORE_r11.1>
sudo apt-mark hold remote-control
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list remote-control
sudo dnf downgrade remote-control-<VERSION_BEFORE_r11.1>
sudo dnf versionlock add remote-control
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: CA BrightStor ARCserve Backup - 'AddColumn()' ActiveX Buffer Overflow (Metasploit)
- Exploit-DB: CA BrightStor ARCserve Backup r11.5 - ActiveX Remote Buffer Overflow
- Metasploit: CA BrightStor ARCserve Backup AddColumn() ActiveX Buffer Overflow
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2008-1472?
brightstor arcserve backup laptops desktops: downgrade or apply the listed mitigation; desktop management suite: downgrade or apply the listed mitigation; unicenter dsm r11 list control atx: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2008-1472 being exploited?
CVE-2008-1472 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2008-1472 affect?
CVE-2008-1472 affects brightstor arcserve backup laptops desktops, desktop management suite, unicenter dsm r11 list control atx. Severity is high (CVSS 9.3). Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products including BrightStor ARCserve Backup R11.5, Desktop Management Suite r11.1 through r11.2, and Unicenter products r11.1 through r11.2
How urgent is CVE-2008-1472?
Priority 62/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference
Related CVEs
- CVE-2007-5006 HIGH 10.0 DOWNGRADE DOWNGRADE Multiple command handlers in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.
- CVE-2007-5005 HIGH 10.0 DOWNGRADE DOWNGRADE Directory traversal vulnerability in rxRPC.dll in CA (Computer Associates) BrightStor ARCserve Backup for Lapt
- CVE-2007-5004 HIGH 9.3 DOWNGRADE DOWNGRADE Integer overflow in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through
- CVE-2007-5003 HIGH 10.0 DOWNGRADE DOWNGRADE Multiple stack-based buffer overflows in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and D
- CVE-2007-3216 HIGH 10.0 DOWNGRADE Multiple buffer overflows in the LGServer component of CA (Computer Associates) BrightStor ARCserve Backup for