PT-2008-2089 · Symantec+1 · Symantec Backup Exec System Recovery Manager+1

Titon · Publicado 2008-02-07 · Atualizado 2018-10-15 · CVE-2008-0457

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Backup Exec System Recovery Manager versions 7.0 through 7.0.1

Description The issue is related to an unrestricted file upload vulnerability in the FileUpload class of the Symantec LiveState Apache Tomcat server. This vulnerability allows remote attackers to upload and execute arbitrary JSP files.

Recommendations For Symantec Backup Exec System Recovery Manager versions 7.0 through 7.0.1, consider restricting access to the FileUpload class as a temporary workaround until a patch is available.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-0457

Produtos afetados

Apache Tomcat

Symantec Backup Exec System Recovery Manager

Referências · 11

• 🔥 http://securityfocus.com/bid/27487 · Exploit
• 🔥 https://exploit-db.com/exploits/5078 · Exploit
• 🔥 https://exploit-db.com/exploits/31072 · Exploit
• http://securityfocus.com/archive/1/487688/100/0/threaded · Nota
• http://vupen.com/english/advisories/2008/0413 · Aviso do Fabricante
• http://zerodayinitiative.com/advisories/ZDI-08-003.html · Nota
• http://secunia.com/advisories/28787 · Aviso do Fabricante
• http://symantec.com/avcenter/security/Content/2008.02.04.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-0457 · Nota de Segurança
• http://securitytracker.com/id?1019303 · Nota
• http://seer.entsupport.symantec.com/docs/297171.htm · Correção