PT-2008-2262 · Symantec · Symantec Veritas Storage Foundation

Sebastian Apelt · Publicado 2008-02-21 · Atualizado 2018-10-15 · CVE-2008-0638

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Veritas Storage Foundation version 5.0

Description The issue is related to a heap-based buffer overflow in the Veritas Enterprise Administrator (VEA) service, also known as vxsvc.exe. This allows remote attackers to execute arbitrary code by sending a packet with a crafted value of a certain size field. The problem arises because the size field is not checked for consistency with the actual buffer size.

Recommendations For Symantec Veritas Storage Foundation version 5.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-0638

Produtos afetados

Symantec Veritas Storage Foundation

Referências · 8

• http://securitytracker.com/id?1019459 · Nota
• http://secunia.com/advisories/29050 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0638 · Nota de Segurança
• http://securityfocus.com/bid/25778 · Correção
• http://zerodayinitiative.com/advisories/ZDI-08-007.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0638 · Nota
• http://securityfocus.com/archive/1/488420/100/0/threaded · Nota
• http://symantec.com/avcenter/security/Content/2008.02.20a.html · Correção