PT-2013-5127 · Symantec · Symantec Backup Exec

Publicado 2013-08-04 · Atualizado 2013-08-22 · CVE-2013-4677

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Backup Exec versions 2010 R3 before 2010 R3 SP3 Symantec Backup Exec versions 2012 before SP2

Description The issue allows local users to obtain sensitive information or modify the outcome of a restore by accessing backup data files directly, due to weak permissions set for these files, specifically Everyone: Read and Everyone: Change.

Recommendations For Symantec Backup Exec version 2010 R3 before 2010 R3 SP3, update to 2010 R3 SP3 or later to resolve the issue. For Symantec Backup Exec version 2012 before SP2, update to SP2 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-4677

Produtos afetados

Symantec Backup Exec

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-4677 · Nota de Segurança
• http://securityfocus.com/bid/61487 · Nota
• http://osvdb.org/95939 · Nota
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130801_00 · Aviso do Fabricante