PT-2008-1529 · Symantec · Symantec Backup Exec

Jj Reyes · Publicado 2008-02-29 · Atualizado 2017-09-29 · CVE-2007-6016

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Backup Exec for Windows Server versions 11.0.6235 through 11.0.7170 Symantec Backup Exec for Windows Server version 12.0.1364

Description The issue is related to multiple stack-based buffer overflows in the PVATLCalendar.PVCalendar.1 ActiveX control. This can be exploited by remote attackers to execute arbitrary code via long property values, such as DOWText0, DOWText1, DOWText2, DOWText3, DOWText4, DOWText5, DOWText6, MonthText0, MonthText1, MonthText2, MonthText3, MonthText4, MonthText5, MonthText6, MonthText7, MonthText8, MonthText9, MonthText10, or MonthText11, when executing the Save method. It is noted that while the vendor states authenticated user involvement is required, authentication is not needed to attack a client machine that loads this control.

Recommendations For Symantec Backup Exec for Windows Server versions 11.0.6235 through 11.0.7170, consider disabling the PVATLCalendar.PVCalendar.1 ActiveX control until a patch is available. For Symantec Backup Exec for Windows Server version 12.0.1364, consider disabling the PVATLCalendar.PVCalendar.1 ActiveX control until a patch is available. As a temporary workaround, avoid using long property values for DOWText0, DOWText1, DOWText2, DOWText3, DOWText4, DOWText5, DOWText6, MonthText0, MonthText1, MonthText2, MonthText3, MonthText4, MonthText5, MonthText6, MonthText7, MonthText8, MonthText9, MonthText10, or MonthText11 when executing the Save method.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2007-6016

Produtos afetados

Symantec Backup Exec

Referências · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/symantec_backupexec_pvcalendar.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16582 · Exploit
• 🔥 https://exploit-db.com/exploits/5205 · Exploit
• http://vupen.com/english/advisories/2008/0718 · Aviso do Fabricante
• http://symantec.com/avcenter/security/Content/2008.02.29.html · Correção
• http://vupen.com/english/advisories/2008/2672 · Aviso do Fabricante
• http://secunia.com/advisories/27885 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-6016 · Nota de Segurança
• http://seer.support.veritas.com/docs/308669.htm · Nota
• http://securityfocus.com/bid/26904 · Correção
• http://secunia.com/secunia_research/2007-101/advisory · Aviso do Fabricante
• http://symantec.com/avcenter/security/Content/2008.02.28.html · Nota
• http://securitytracker.com/id?1019524 · Nota