PT-2013-5126 · Symantec · Symantec Backup Exec

Published 2013-08-04 · Updated 2013-08-22 · CVE-2013-4676

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symantec Backup Exec versions 2010 R3 before 2010 R3 SP3 Symantec Backup Exec versions 2012 before SP2

Description The issue allows remote attackers to inject arbitrary web script or HTML via various vectors in the management console and beutility console, including custom-reports generation page, Storage Devices creation page, jobs creation page, and a Backup Exec server-management page.

Recommendations For Symantec Backup Exec versions 2010 R3 before 2010 R3 SP3, update to 2010 R3 SP3 to resolve the issue. For Symantec Backup Exec versions 2012 before SP2, update to SP2 to resolve the issue. As a temporary workaround, consider restricting access to the custom-reports generation page, Storage Devices creation page, jobs creation page, and the Backup Exec server-management page in the beutility console until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-4676

Affected Products

Symantec Backup Exec

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2013-4676 · Security Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130801_00 · Vendor Advisory
• http://osvdb.org/95941 · Note
• http://osvdb.org/95942 · Note
• http://securityfocus.com/bid/61486 · Note