Symantec Backup Exec for Windows Servers Backup Exec Remote Agent security bypass
| backupexec-remoteagent-security-bypass (46730) |  Medium Risk |
Description:
Symantec Backup Exec for Windows Servers could allow a remote attacker to bypass security restrictions, caused by multiple authentication errors within the Backup Exec Remote Agent. A remote attacker could exploit this vulnerability to bypass security restrictions to read and modify arbitrary files on the system.
*CVSS:
| Base Score: | 7.5 |
| Access Vector: | Network |
| Access Complexity: | Low |
| Authentication: | None |
| Confidentiality Impact: | Partial |
| Integrity Impact: | Partial |
| Availability Impact: | Partial |
| Temporal Score: | 5.5 |
| Exploitability: | Unproven |
| Remediation Level: | Official-Fix |
| Report Confidence: | Confirmed |
Consequences:
Bypass Security
Remedy:
Refer to SYM08-021 for patch, upgrade or suggested workaround information. See References.
References:
- SYM08-021 : Symantec Backup Exec Authentication Bypass and Potential Buffer Overflow .
- BID-32347: Symantec Backup Exec for Windows Server Remote Agent Authentication Bypass Vulnerability
- CVE-2008-5407: Multiple unspecified vulnerabilities in the Backup Exec remote-agent logon process in Symantec Backup Exec for Windows Servers 11.0 (aka 11d) builds 6235 and 7170, 12.0 build 1364, and 12.5 build 2213 allow remote attackers to bypass authentication, and read or delete files, via unknown vectors.
- SA32810: Symantec Backup Exec for Windows Servers Multiple Vulnerabilities
- SECTRACK ID: 1021246: Symantec Backup Exec Lets Remote Users Bypass Authentication and Execute Arbitrary Code on the Target System
- VUPEN/ADV-2008-3209: Symantec Backup Exec Security Bypass and Overflow Vulnerabilities
Platforms Affected:
- Symantec Backup Exec for Windows Servers 11d_build_6235
- Symantec Backup Exec for Windows Servers 11d_build_7170
- Symantec Backup Exec for Windows Servers 12.5_build_2213
- Symantec Backup Exec for Windows Servers 12_build_1364
Reported:
Nov 19, 2008
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.