PT-2013-5126 · Symantec · Symantec Backup Exec

Publicado 2013-08-04 · Atualizado 2013-08-22 · CVE-2013-4676

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symantec Backup Exec versions 2010 R3 before 2010 R3 SP3 Symantec Backup Exec versions 2012 before SP2

Description The issue allows remote attackers to inject arbitrary web script or HTML via various vectors in the management console and beutility console, including custom-reports generation page, Storage Devices creation page, jobs creation page, and a Backup Exec server-management page.

Recommendations For Symantec Backup Exec versions 2010 R3 before 2010 R3 SP3, update to 2010 R3 SP3 to resolve the issue. For Symantec Backup Exec versions 2012 before SP2, update to SP2 to resolve the issue. As a temporary workaround, consider restricting access to the custom-reports generation page, Storage Devices creation page, jobs creation page, and the Backup Exec server-management page in the beutility console until a patch is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-4676

Produtos afetados

Symantec Backup Exec

Referências · 5

• http://osvdb.org/95941 · Nota
• http://osvdb.org/95942 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4676 · Nota de Segurança
• http://securityfocus.com/bid/61486 · Nota
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130801_00 · Aviso do Fabricante