PT-2013-5127 · Symantec · Symantec Backup Exec

Published 2013-08-04 · Updated 2013-08-22 · CVE-2013-4677

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Backup Exec versions 2010 R3 before 2010 R3 SP3 Symantec Backup Exec versions 2012 before SP2

Description The issue allows local users to obtain sensitive information or modify the outcome of a restore by accessing backup data files directly, due to weak permissions set for these files, specifically Everyone: Read and Everyone: Change.

Recommendations For Symantec Backup Exec version 2010 R3 before 2010 R3 SP3, update to 2010 R3 SP3 or later to resolve the issue. For Symantec Backup Exec version 2012 before SP2, update to SP2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-4677

Affected Products

Symantec Backup Exec

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-4677 · Security Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130801_00 · Vendor Advisory
• http://securityfocus.com/bid/61487 · Note
• http://osvdb.org/95939 · Note