PT-2011-2434 · Symantec+1 · Symantec Backup Exec+1

Nibin · Publicado 2011-05-31 · Atualizado 2016-08-23 · CVE-2011-0546

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:A/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Backup Exec versions 11.0 through 13.0 R2

Description The issue allows man-in-the-middle attackers to execute NDMP commands via unspecified vectors, due to the lack of validation of identity information sent between the media server and the remote agent.

Recommendations For Symantec Backup Exec versions 11.0 through 13.0 R2, consider restricting access to the remote agent to minimize the risk of exploitation until a patch is available.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-0546

HPSBUX02700

Produtos afetados

Hp-Ux

Symantec Backup Exec

Referências · 10

• 🔥 https://exploit-db.com/exploits/17517 · Exploit
• http://securityreason.com/securityalert/8300 · Nota
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110526_00 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0546 · Nota de Segurança
• http://secunia.com/advisories/44698 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0547 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=131489365508507&w=2 · Aviso do Fabricante
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMjk2MjI2Mg%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota
• http://securityfocus.com/bid/47824 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0546 · Nota de Segurança