PT-2008-6524 · Symantec · Symantec Backup Exec

Published 2008-12-09 · Updated 2017-08-08 · CVE-2008-5407

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Symantec Backup Exec for Windows Servers versions 11.0 through 12.5 build 2213

Description The issue allows remote attackers to bypass authentication and read or delete files via unknown vectors in the Backup Exec remote-agent logon process.

Recommendations For Symantec Backup Exec for Windows Servers version 11.0, update to a version outside of the affected range. For Symantec Backup Exec for Windows Servers version 12.0, update to a version outside of the affected range. For Symantec Backup Exec for Windows Servers version 12.5 build 2213 and earlier, update to a version outside of the affected range.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-5407

Affected Products

Symantec Backup Exec

References · 8

• http://seer.entsupport.symantec.com/docs/314528.htm · Vendor Advisory
• http://securityresponse.symantec.com/avcenter/security/Content/2008.11.19.html · Vendor Advisory
• http://secunia.com/advisories/32810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5407 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46730 · Note
• http://securityfocus.com/bid/32347 · Note
• http://securitytracker.com/id?1021246 · Note
• http://vupen.com/english/advisories/2008/3209 · Note