PT-2008-2262 · Symantec · Symantec Veritas Storage Foundation

Sebastian Apelt · Published 2008-02-21 · Updated 2018-10-15 · CVE-2008-0638

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Veritas Storage Foundation version 5.0

Description The issue is related to a heap-based buffer overflow in the Veritas Enterprise Administrator (VEA) service, also known as vxsvc.exe. This allows remote attackers to execute arbitrary code by sending a packet with a crafted value of a certain size field. The problem arises because the size field is not checked for consistency with the actual buffer size.

Recommendations For Symantec Veritas Storage Foundation version 5.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-0638

Affected Products

Symantec Veritas Storage Foundation

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-0638 · Security Note
• http://securityfocus.com/bid/25778 · Patch
• http://symantec.com/avcenter/security/Content/2008.02.20a.html · Patch
• http://securitytracker.com/id?1019459 · Note
• http://secunia.com/advisories/29050 · Note
• http://zerodayinitiative.com/advisories/ZDI-08-007.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0638 · Note
• http://securityfocus.com/archive/1/488420/100/0/threaded · Note