PT-2006-2314 · Veritas · Veritas Backup Exec

Published 2006-03-19 · Updated 2018-10-18 · CVE-2006-1298

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Veritas Backup Exec versions 9.1 through 10.1

Description The issue is related to a format string vulnerability in the Job Engine service of the Media Server in Veritas Backup Exec. This vulnerability can be exploited by remote authenticated users when the job log mode is set to Full Detailed. By using a crafted filename on a machine backed up by Backup Exec, an attacker can cause a denial of service and possibly execute arbitrary code.

Recommendations For Veritas Backup Exec version 9.1, update to a version that is not affected by this issue. For Veritas Backup Exec version 10.0, update to a version that is not affected by this issue. For Veritas Backup Exec version 10.1, update to a version that is not affected by this issue. As a temporary workaround, consider setting the job log mode to a level other than Full Detailed to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-1298

Affected Products

Veritas Backup Exec

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-1298 · Security Note
• http://support.veritas.com/docs/282254 · Vendor Advisory
• http://securityfocus.com/bid/17096 · Patch
• http://secunia.com/advisories/19242 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25310 · Note
• http://securityfocus.com/archive/1/428223/100/0/threaded · Note
• http://securitytracker.com/id?1015785 · Note
• http://symantec.com/avcenter/security/Content/2006.03.17b.html · Note
• http://vupen.com/english/advisories/2006/0996 · Note