Veritas Backup Exec Web Administration Console Remote Buffer Overflow Vulnerability

Bugtraq ID:	14025
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 22 2005 12:00AM
Updated:	Jul 06 2006 11:44PM
Credit:	This issue is credited to Mark Litchfield of NGSSoftware.
Vulnerable:	Veritas Software Backup Exec for Windows Servers 10.0 rev. 5484 Veritas Software Backup Exec for Windows Servers 9.1 rev. 4691 Veritas Software Backup Exec for Windows Servers 9.1 Veritas Software Backup Exec for Windows Servers 9.0 rev. 4454 Veritas Software Backup Exec for Windows Servers 9.0 rev. 4367 Veritas Software Backup Exec for Windows Servers 9.0 Veritas Software Backup Exec for Windows Servers 8.6 Veritas Software Backup Exec for Windows Servers 8.5 Veritas Software Backup Exec for Windows Servers 8.0
Not Vulnerable:	Veritas Software Backup Exec for Windows Servers 10.0 rev. 5520

Veritas Backup Exec Web Administration Console Remote Buffer Overflow Vulnerability

VERITAS Backup Exec Web Administration Console is prone to a remote buffer-overflow vulnerability.

An attacker can exploit this issue by crafting a malicious request. This request must contain excessive string data that triggers this issue, replacement memory addresses, and executable instructions. When the Web Administration Console processes this request, the attacker-supplied instructions may run on the vulnerable computer.

Veritas Backup Exec Web Administration Console Remote Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Veritas Backup Exec Web Administration Console Remote Buffer Overflow Vulnerability

Solution:
The vendor has released an advisory (VX05-005) and fixes to address this issue:


Veritas Software Backup Exec for Windows Servers 10.0 rev. 5484

• Veritas VERITAS Backup Exec 10.0 rev. 5484 for Windows Servers - upgrade to Backup Exec 10.0 rev. 5520
  http://support.veritas.com/docs/277181


• Veritas VERITAS Backup Exec 10.0 rev. 5484 for Windows Servers Hotfix 24
  http://support.veritas.com/docs/275514

Veritas Software Backup Exec for Windows Servers 8.6

• Veritas Software BENT86HF68_273422.exe
  http://seer.support.veritas.com/docs/273422.htm

Veritas Software Backup Exec for Windows Servers 9.1

• Veritas Software Be4691RHF40_273420.exe
  http://seer.support.veritas.com/docs/273420.htm

Veritas Software Backup Exec for Windows Servers 9.1 rev. 4691

• Veritas VERITAS Backup Exec 9.1 rev. 4691 for Windows Servers Hotfix 52
  http://support.veritas.com/docs/275909


• Veritas VERITAS Backup Exec 9.1 rev. 4691 for Windows Servers Installation Media
  http://support.veritas.com/docs/264658

Veritas Backup Exec Web Administration Console Remote Buffer Overflow Vulnerability

References:

• Document ID: 273419 - stack-based buffer overflow vuln in Backup Exec 8 and 9 (Veritas Software)
  
• Metasploit Framework Exploits (Metasploit)
  
• Veritas Homepage (Veritas Software)
  
• VX05-005 - Buffer overflow vulnerability in VERITAS Software Backup Exec Web Adm (Veritas Software)
  
• Buffer overflow vulnerability in VERITAS Software Backup Exec Web Administration ("NGSSoftware Insight Security Research" )
  
• iDEFENSE Security Advisory 12.16.04: Veritas Backup Exec Agent Browser (iDEFENSE Security Advisory )