PT-2008-6525 · Symantec · Symantec Backup Exec For Windows Servers

Published 2008-12-09 · Updated 2017-08-08 · CVE-2008-5408

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Backup Exec for Windows Servers version 11.0 Symantec Backup Exec for Windows Servers versions 12.0 through 12.5

Description A buffer overflow issue exists in the data management protocol, allowing remote authenticated users to cause a denial of service and possibly execute arbitrary code via unknown vectors. This issue can also be exploited by unauthenticated remote attackers.

Recommendations For Symantec Backup Exec for Windows Servers version 11.0, update to a version that is not affected by this issue. For Symantec Backup Exec for Windows Servers versions 12.0 through 12.5, update to a version that is not affected by this issue. As a temporary workaround, consider restricting access to the data management protocol to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-5408

Affected Products

Symantec Backup Exec For Windows Servers

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-5408 · Security Note
• http://seer.entsupport.symantec.com/docs/314528.htm · Vendor Advisory
• http://securityresponse.symantec.com/avcenter/security/Content/2008.11.19.html · Vendor Advisory
• http://secunia.com/advisories/32810 · Vendor Advisory
• http://securityfocus.com/bid/32346 · Patch
• http://securitytracker.com/id?1021246 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46731 · Note
• http://vupen.com/english/advisories/2008/3209 · Note