Symantec Storage Foundation for Windows Security Update Circumvention Vulnerability

Bugtraq ID:	30596
Class:	Design Error
CVE:	CVE-2008-3703
Remote:	Yes
Local:	Yes
Published:	Aug 14 2008 12:00AM
Updated:	May 07 2015 05:25PM
Credit:	Tenable Security, working through 3Com Zero Day Initiative, discovered this vulnerability.
Vulnerable:	Symantec Storage Foundation for Windows 5.1 Symantec Storage Foundation for Windows 5.0 RP1 Symantec Storage Foundation for Windows 5.0
Not Vulnerable:

Symantec Storage Foundation for Windows Security Update Circumvention Vulnerability

Symantec Storage Foundation for Windows is prone to a vulnerability that lets attackers circumvent security updates. The issue resides in the Volume Manager Scheduler Service.

Successful exploits of this issue allow attackers to circumvent a previous security update that resolved authentication-bypass and remote code-execution vulnerabilities. This may facilitate the complete compromise of affected computers.

Storage Foundation 5.0, 5.0 RP1, and 5.1 are vulnerable.

Symantec Storage Foundation for Windows Security Update Circumvention Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Symantec Storage Foundation for Windows Security Update Circumvention Vulnerability

Solution:
Vendor fixes are available. Please see the references for more information.

Symantec Storage Foundation for Windows Security Update Circumvention Vulnerability

References:

• Storage Foundation for Windows Product Page (Symantec)
  
• SYM08-015_SFW_SecurityUpdateBypass ("Mike Prosser" )
  
• ZDI-08-053: Symantec Veritas Storage Foundation Scheduler Service NULL Session A ([email protected])
  
• SYM08-015 Veritas Storage Foundation for Windows Volume Manager Scheduler Servic (Symantec)
  
• ZDI-08-053 Symantec Veritas Storage Foundation Scheduler Service NULL Session Au (Zero Day Initiative)