PT-2005-1801 · Veritas · Veritas Backup Exec

Published 2005-06-26 · Updated 2023-12-28 · CVE-2005-0772

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions VERITAS Backup Exec versions 9.0 through 10.0 for Windows Servers VERITAS Backup Exec versions 9.0.4019 through 9.1.307 for Netware

Description The issue allows remote attackers to cause a denial of service, resulting in a Remote Agent crash. This can be achieved via a crafted packet in NDMLSRVR.DLL or a request packet with an invalid Error Status value, which triggers a null dereference.

Recommendations For VERITAS Backup Exec versions 9.0 through 10.0 for Windows Servers, consider disabling the NDMLSRVR.DLL until a patch is available to prevent exploitation. For VERITAS Backup Exec versions 9.0.4019 through 9.1.307 for Netware, restrict the use of request packets with invalid Error Status values to minimize the risk of a Remote Agent crash. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2005-0772

Affected Products

Veritas Backup Exec

References · 8

• http://idefense.com/application/poi/display?id=270&type=vulnerabilities&flashstatus=true · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0772 · Security Note
• http://seer.support.veritas.com/docs/276533.htm · Note
• http://idefense.com/application/poi/display?id=271&type=vulnerabilities · Note
• http://secunia.com/advisories/15789 · Note
• http://seer.support.veritas.com/docs/277485.htm · Note
• http://securitytracker.com/id?1014273 · Note
• https://t.me/cvenotify/65428 · Telegram Post