The Tape Engine service in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5 Enterprise Backup 10.5 and CA Server/Business Protection Suite r2 allows remote attackers to execute arbitrary code via certain data in opnum 0xBF in an RPC request which is directly executed.