PT-2011-2435 · Veritas+2 · Veritas Storage Foundation Cluster File System+5

Luigi Auriemma · Published 2011-08-16 · Updated 2017-09-19 · CVE-2011-0547

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Veritas Storage Foundation versions 5.1 and earlier Veritas Storage Foundation Cluster File System (SFCFS) versions 5.1 and earlier Veritas Storage Foundation Cluster File System Enterprise for Oracle RAC (SFCFSORAC) versions 5.1 and earlier Veritas Dynamic Multi-Pathing (DMP) version 5.1 NetBackup PureDisk versions 6.5.x through 6.6.1.x

Description The issue is related to multiple integer overflows in vxsvc.exe, which can be exploited by remote attackers to execute arbitrary code. This can be achieved through a crafted Unicode string, a crafted ASCII string, or a crafted value, all related to specific functions within the vxveautil module, such as vxveautil.value binary unpack and vxveautil.kv binary unpack. These crafted inputs can lead to a buffer overflow.

Recommendations For Symantec Veritas Storage Foundation versions 5.1 and earlier, consider disabling the vxveautil.value binary unpack and vxveautil.kv binary unpack functions until a patch is available. For Veritas Storage Foundation Cluster File System (SFCFS) versions 5.1 and earlier, restrict access to the vxsvc.exe service to minimize the risk of exploitation. For Veritas Storage Foundation Cluster File System Enterprise for Oracle RAC (SFCFSORAC) versions 5.1 and earlier, avoid using the vulnerable vxveautil module in critical operations. For Veritas Dynamic Multi-Pathing (DMP) version 5.1, temporarily disable the vxveautil module to prevent potential attacks. For NetBackup PureDisk versions 6.5.x through 6.6.1.x, restrict the use of ASCII and Unicode string parsing functions related to vxveautil.value binary unpack until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2011-0547

HPSBUX02700

ZDI-11-262

ZDI-11-263

ZDI-11-264

Affected Products

Hp-Ux

Netbackup Puredisk

Symantec Veritas Storage Foundation

Veritas Dynamic Multi-Pathing

Veritas Storage Foundation Cluster File System

Veritas Storage Foundation Cluster File System Enterprise For Oracle Rac

References · 16

• http://symantec.com/business/support/index?page=content&id=TECH165536 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-11-262 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0546 · Security Note
• http://marc.info/?l=bugtraq&m=131955939603667&w=2 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-11-263 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0547 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-11-264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-0547 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-11-263 · Note
• http://zerodayinitiative.com/advisories/ZDI-11-264 · Note
• http://securityfocus.com/bid/49014 · Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110815_00 · Note
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMjk2MjI2Mg%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Note
• http://zerodayinitiative.com/advisories/ZDI-11-262 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14792 · Note