Title: Symantec Backup Exec Multiple Heap Overflow Vulnerabilities
Severity: CRITICAL
Description:
Symantec Backup Exec is a network-enabled backup solution.
Symantec Backup Exec for Windows Servers and Remote Agents, Continuous Protection Server, and Backup Exec for Netware Servers are prone to multiple heap-overflow vulnerabilities because the software fails to properly bounds-check user-supplied input before copying it to insufficiently sized memory buffers.
These issues are due to flaws in the RPC interface. Attackers may exploit these issues by sending specially formatted internal network calls to the affected RPC interfaces.
A remote, authenticated attacker may exploit these vulnerabilities to execute arbitrary code and gain administrative privileges on vulnerable computers. Failed exploit attempts may result in denial-of-service conditions.
Affected Products:
- Symantec Backup Exec Continuous Protection Server 10.1.325.6301
- Symantec Backup Exec Continuous Protection Server 10.1.326 .2501
- Symantec Backup Exec Continuous Protection Server 10.1.326 .3301
- Symantec Backup Exec Continuous Protection Server 10.1.326.1401
- Symantec Backup Exec Continuous Protection Server 10.1.326.2501
- Symantec Backup Exec Continuous Protection Server 10.1.327 .401
- Symantec Backup Exec for Netware Servers Remote Agent 9.1
- Symantec Backup Exec for Netware Servers Remote Agent 9.2
- Symantec Backup Exec for Windows Server Remote Agent 10.0
- Symantec Backup Exec for Windows Server Remote Agent 10.0 Build 10.0.5484
- Symantec Backup Exec for Windows Server Remote Agent 10.0 Build 10.0.5520
- Symantec Backup Exec for Windows Server Remote Agent 10.1
- Symantec Backup Exec for Windows Server Remote Agent 10.1 Build 10.1.5629
- Symantec Backup Exec for Windows Server Remote Agent 9.1
- Symantec Backup Exec for Windows Server Remote Agent 9.1 Build 9.1.4691
References:
- Symantec: SYM06-014: Symantec Backup Exec for Windows Server: RPC Interface Heap Overflow,
- Symantec: Symantec Security Advisory SYM06-014 - Backup Exec for NetWare Servers Remote Ag
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
