{"vuid":"VU#647796","idnumber":"647796","name":"Symantec Veritas Backup Exec for Windows Server vulnerable to heap-based buffer overflow","keywords":["Symantec","Backup Exec","heap-based","buffer overflow","RPC interface","RAWS"],"overview":"Symantec Veritas Backup Exec for Windows Server contains multiple heap-based buffer overflow vulnerabilities which can allow a remote, authenticated attacker to cause a denial of service or execute arbitrary code.","clean_desc":"VERITAS Backup Exec for Windows Server is a data backup and recovery solution with support for network-based backups. The VERITAS Backup Exec Remote Agent is installed on systems that are to be backed up. It listens on TCP port 10000 for messages indicating that a backup should occur. The remote agent software fails to properly validate incoming packets, which allows a buffer overflow to occur. Specially crafted RPC messages can be used to trigger the buffer overflow, making it possible for an authenticated attacker to exploit this vulnerability. The following products are affected: Backup Exec for Windows Server and Remote Agent 9.1  9.1.4691\nBackup Exec for Windows Server and Remote Agent 10.0  10.0.5484\nBackup Exec for Windows Server and Remote Agent 10.0  10.0.5520\nBackup Exec for Windows Server and Remote Agent 10.1  10.1.5629\nBackup Exec Continuous Protection Server Remote Agent for Windows Server 10.1  10.1.325.6301\nBackup Exec Continuous Protection Server Remote Agent for Windows Server 10.1  10.1.326.1401\nBackup Exec Continuous Protection Server Remote Agent for Windows Server 10.1  10.1.326.2501\nBackup Exec Continuous Protection Server Remote Agent for Windows Server 10.1  10.1.326.3301\nBackup Exec Continuous Protection Server Remote Agent for Windows Server 10.1  10.1.327.401\nBackup Exec for Netware Server Remote Agent for Windows Server 9.1 All\nBackup Exec for Netware Server Remote Agent for Windows Server 9.2 All","impact":"By sending a specially crafted RPC message to the target system, a remote, autenticated attacker can cause a heap-based buffer overflow. This may allow execution of arbitrary code and gain elevated privileges, or cause a denial of service.","resolution":"Upgrade Apply the update provided by Symantec. Refer to Synantec Advisory SYM06-014 for more information.","workarounds":"","sysaffected":"","thanks":"This vulnerability was reported by Symantec, who in turn credit \nNicolas Pouvesle from Tenable Network Security.","author":"This document was written by Joseph Pruszynski.","public":["http://securityresponse.symantecsecurity/Content/2006.08.11.html","http://secunia.com/advisories/21472/","http://www.securityfocus.com/bid/19479","http://xforce.iss.net/xforce/xfdb/28336"],"cveids":["CVE-2006-4128"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2006-08-15T16:57:49Z","publicdate":"2006-08-12T00:00:00Z","datefirstpublished":"2006-08-21T15:53:10Z","dateupdated":"2006-08-21T18:09:59Z","revision":26,"vrda_d1_directreport":"0","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"11","cam_population":"11","cam_impact":"8","cam_easeofexploitation":"7","cam_attackeraccessrequired":"1","cam_scorecurrent":"0.3003","cam_scorecurrentwidelyknown":"0.35805","cam_scorecurrentwidelyknownexploited":"0.58905","ipprotocol":"tcp","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":0.3003,"vulnote":null}