Symantec VERITAS NetBackup error in status value denial of service
| Netbackup-dos (21105) |  Low Risk |
Description:
VERITAS NetBackup for NetWare Media Servers is a backup and recovery software solution for Microsoft Windows and Unix-based operating systems. NetBackup version 4.5, 4.5 Maint Pack 1 - 4.5 MP8, 4.5 Feature Pack 1 - 4.5 Feature Pack 8, 5.0 and 5.0 Maint Pack 1 - MP5, 5.1, and 5.1 Maintenance Pack 1 - MP 3 running on Novell NetWare Media Servers are vulnerable to a denial of service attack caused by a buffer overflow. The NetBackup Server fails to properly handle request packets with a status value. A remote attacker could use this vulnerability to overflow a buffer and cause the system to crash.
Platforms Affected:
- Novell, NetWare 5.1
- Novell, NetWare 6.0
- Novell, NetWare 6.5
- Symantec, VERITAS NetBackup Server
Remedy:
Apply the appropriate patch for your system, as listed in the Veritas Document ID: 277485. See References.
Consequences:
Denial of Service
References:
- Veritas Document ID: 277485, Denial of Service (DoS) in VERITAS NetBackup (tm) for NetWare Media Servers at http://seer.support.veritas.com/docs/277485.htm.
- Veritas NetBackup Web page, NetBackup¿ Server at http://www.veritas.com/Products/www?c=product&refId=58.
- BID-14019: Veritas Backup Exec/NetBackup Request Packet Denial Of Service Vulnerability
- BID-14021: Veritas Backup Exec Remote Agent Null Pointer Dereference Denial Of Service Vulnerability
- CVE-2005-0772: VERITAS Backup Exec 9.0 through 10.0 for Windows Servers, and 9.0.4019 through 9.1.307 for Netware, allows remote attackers to cause a denial of service (Remote Agent crash) via (1) a crafted packet in NDMLSRVR.DLL or (2) a request packet with an invalid (non-0) Error Status value, which triggers a null dereference.
- SA15789: VERITAS Backup Exec Multiple Vulnerabilities
- SECTRACK ID: 1014273: Veritas Backup Exec Bugs Let Remote Users Execute Arbitrary Code, Crash the System, and Modify the Registry
Reported:
Jun 22, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net