PT-2008-1529 · Symantec · Symantec Backup Exec

Jj Reyes · Published 2008-02-29 · Updated 2017-09-29 · CVE-2007-6016

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Backup Exec for Windows Server versions 11.0.6235 through 11.0.7170 Symantec Backup Exec for Windows Server version 12.0.1364

Description The issue is related to multiple stack-based buffer overflows in the PVATLCalendar.PVCalendar.1 ActiveX control. This can be exploited by remote attackers to execute arbitrary code via long property values, such as DOWText0, DOWText1, DOWText2, DOWText3, DOWText4, DOWText5, DOWText6, MonthText0, MonthText1, MonthText2, MonthText3, MonthText4, MonthText5, MonthText6, MonthText7, MonthText8, MonthText9, MonthText10, or MonthText11, when executing the Save method. It is noted that while the vendor states authenticated user involvement is required, authentication is not needed to attack a client machine that loads this control.

Recommendations For Symantec Backup Exec for Windows Server versions 11.0.6235 through 11.0.7170, consider disabling the PVATLCalendar.PVCalendar.1 ActiveX control until a patch is available. For Symantec Backup Exec for Windows Server version 12.0.1364, consider disabling the PVATLCalendar.PVCalendar.1 ActiveX control until a patch is available. As a temporary workaround, avoid using long property values for DOWText0, DOWText1, DOWText2, DOWText3, DOWText4, DOWText5, DOWText6, MonthText0, MonthText1, MonthText2, MonthText3, MonthText4, MonthText5, MonthText6, MonthText7, MonthText8, MonthText9, MonthText10, or MonthText11 when executing the Save method.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-6016

Affected Products

Symantec Backup Exec

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/symantec_backupexec_pvcalendar.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16582 · Exploit
• 🔥 https://exploit-db.com/exploits/5205 · Exploit
• http://vupen.com/english/advisories/2008/0718 · Vendor Advisory
• http://symantec.com/avcenter/security/Content/2008.02.29.html · Patch
• http://vupen.com/english/advisories/2008/2672 · Vendor Advisory
• http://secunia.com/advisories/27885 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6016 · Security Note
• http://securityfocus.com/bid/26904 · Patch
• http://secunia.com/secunia_research/2007-101/advisory · Vendor Advisory
• http://seer.support.veritas.com/docs/308669.htm · Note
• http://symantec.com/avcenter/security/Content/2008.02.28.html · Note
• http://securitytracker.com/id?1019524 · Note