Veritas Backup Exec Multiple Remote Denial of Service Vulnerabilities

Bugtraq ID:	17098
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-1297
Remote:	Yes
Local:	No
Published:	Mar 17 2006 12:00AM
Updated:	Jun 05 2006 10:57PM
Credit:	These issues were identified by the vendor.
Vulnerable:	Veritas Software Backup Exec for NetWare Servers 9.1.1156 Veritas Software Backup Exec for NetWare Servers 9.1.1154 Veritas Software Backup Exec for NetWare Servers 9.1.1152 .4 Veritas Software Backup Exec for NetWare Servers 9.1.1152 Veritas Software Backup Exec for NetWare Servers 9.1.1151 .1 Veritas Software Backup Exec for NetWare Servers 9.1.1127 .1 Veritas Software Backup Exec for NetWare Servers 9.1.1067 .3 Veritas Software Backup Exec for NetWare Servers 9.1.1067 .2 Veritas Software Backup Exec for NetWare Servers 9.1.307 Veritas Software Backup Exec for NetWare Servers 9.1.306 Symantec Remote Agent for Linux Servers 10.1 Symantec Remote Agent for Linux Servers 10.0 Symantec NetBackup for Netware Media Server Option 6.0 Symantec NetBackup for Netware Media Server Option 5.1 Symantec NetBackup for Netware Media Server Option 5.0 Symantec NetBackup for Netware Media Server Option 4.5 MP Symantec NetBackup for Netware Media Server Option 4.5 FP Symantec Backup Exec for Windows Server Remote Agent 9.1 Symantec Backup Exec for Windows Server Remote Agent 10.1 Symantec Backup Exec for Windows Server Remote Agent 10.0 Symantec Backup Exec for Netware Servers Remote Agent 9.2 Symantec Backup Exec for Netware Servers Remote Agent 9.1 Symantec Backup Exec for Netware Servers 9.2 Symantec Backup Exec Continuous Protection Server 10.1.326 .2501 Symantec Backup Exec Continuous Protection Server 10.1.326 .1401 Symantec Backup Exec Continuous Protection Server 10.1.325 .6301
Not Vulnerable:

Veritas Backup Exec Multiple Remote Denial of Service Vulnerabilities

Veritas Backup Exec is prone to multiple remote denial-of-service vulnerabilities.

These issues result in memory violations and memory exhaustion and lead to denial-of-service conditions in the affected applications. A restart is required to regain normal functionality in most cases.

Various versions of Backup Exec for Windows, Linux, and NetWare are vulnerable. NetBackup for NetWare Media Server Option releases, and Backup Exec Continuous Protection Server are also affected.

Veritas Backup Exec Multiple Remote Denial of Service Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Veritas Backup Exec Multiple Remote Denial of Service Vulnerabilities

Solution:
Symantec has released adviosry SYM06-004 to address these issues. Please see the references for more information about obtaining fixes.


Symantec Backup Exec Continuous Protection Server 10.1.325 .6301

• Symantec CPSPatch_283478.exe
  http://seer.support.veritas.com/downloads/export.asp?ddProduct=BEWNT&f ile=CPSPatch_283478.exe&source=1&url=/pub/support/products/Backup_Exec _for_WindowsNT/&id=283478

Symantec Backup Exec Continuous Protection Server 10.1.326 .2501

• Symantec CPSPatch_283478.exe
  http://seer.support.veritas.com/downloads/export.asp?ddProduct=BEWNT&f ile=CPSPatch_283478.exe&source=1&url=/pub/support/products/Backup_Exec _for_WindowsNT/&id=283478

Symantec Backup Exec Continuous Protection Server 10.1.326 .1401

• Symantec CPSPatch_283478.exe
  http://seer.support.veritas.com/downloads/export.asp?ddProduct=BEWNT&f ile=CPSPatch_283478.exe&source=1&url=/pub/support/products/Backup_Exec _for_WindowsNT/&id=283478

Veritas Backup Exec Multiple Remote Denial of Service Vulnerabilities

References:

• Potential security vulnerabilities in the Backup Exec Continuous Protection Serv (Symantec)
  
• SYM06-004 - Veritas Backup Exec: Application Memory Denial of Service (Symantec)
  
• Symantec Security Advisory SYM06-004 - Backup Exec Remote Agents (RAWS, RANW, & (Symantec)