PT-2012-2481 · Symantec · Symantec Backup Exec System Recovery+1

Published 2012-07-23 · Updated 2013-02-02 · CVE-2012-0305

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec System Recovery versions prior to 2011 SP2 Symantec Backup Exec System Recovery versions prior to 2010 SP5

Description The issue allows local users to gain privileges via a Trojan horse DLL in the current working directory. This is due to an untrusted search path vulnerability.

Recommendations For Symantec System Recovery versions prior to 2011 SP2, update to Symantec System Recovery 2011 SP2 or later. For Symantec Backup Exec System Recovery versions prior to 2010 SP5, update to Symantec Backup Exec System Recovery 2010 SP5 or later.

Fix

Related Identifiers

CVE-2012-0305

Affected Products

Symantec Backup Exec System Recovery

Symantec System Recovery

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-0305 · Security Note
• http://securityfocus.com/bid/54594 · Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_01 · Note