PT-2007-5532 · Symantec · Symantec Backup Exec

Publicado 2007-11-29 · Atualizado 2018-10-15 · CVE-2007-4347

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Symantec Backup Exec for Windows Servers versions 11.0.6.6235 through 11.0.7170

Description The issue is related to multiple integer overflows in the Job Engine service, which can be exploited by remote attackers. This is done by sending a crafted packet to port 5633/tcp, triggering an infinite loop that leads to a denial of service due to CPU and memory consumption.

Recommendations For Symantec Backup Exec for Windows Servers versions 11.0.6.6235 through 11.0.7170, consider restricting access to port 5633/tcp to minimize the risk of exploitation. As a temporary workaround, limiting the resources available to the Job Engine service may help mitigate the impact of the denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2007-4347

Produtos afetados

Symantec Backup Exec

Referências · 10

• http://securityfocus.com/archive/1/484318/100/0/threaded · Nota
• http://securityfocus.com/bid/26029 · Correção
• http://securityresponse.symantec.com/avcenter/security/Content/2007.11.27.html · Correção
• http://secunia.com/secunia_research/2007-74/advisory · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-4347 · Nota de Segurança
• http://securitytracker.com/id?1019001 · Nota
• http://securityfocus.com/archive/1/484333/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38677 · Nota
• http://secunia.com/advisories/26975 · Correção
• http://vupen.com/english/advisories/2007/4019 · Nota