Symantec Veritas File System 'qiomkfile' Local Information Disclosure Vulnerability

Bugtraq ID:	31678
Class:	Design Error
CVE:	CVE-2008-3248
Remote:	No
Local:	Yes
Published:	Oct 20 2008 12:00AM
Updated:	Oct 21 2008 09:06PM
Credit:	Derek Callaway
Vulnerable:	Veritas Software File System 3.5 Veritas Software File System 3.4 Veritas Software File System 3.3.3 Veritas Software File System 3.2 Veritas Software File System 5.0 Veritas Software File System 4.1
Not Vulnerable:	Veritas Software File System 5.0 MP3

Symantec Veritas File System 'qiomkfile' Local Information Disclosure Vulnerability

Symantec Veritas File System (VxFS) is prone to an information-disclosure vulnerability.

Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks.

Versions prior to Veritas File System 5.0 MP3 are affected.

Symantec Veritas File System 'qiomkfile' Local Information Disclosure Vulnerability

An attacker can exploit this issue using readily available tools.

Symantec Veritas File System 'qiomkfile' Local Information Disclosure Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for more information.

Symantec Veritas File System 'qiomkfile' Local Information Disclosure Vulnerability

References:

• Symantec Veritas Storage Foundation Product Page (Symantec)
  
• SECOBJADV-2008-04: Symantec Veritas Storage Foundation Memory Disclosure Vulnera (Security Objectives Corporation )
  
• SYM08-018 - Veritas File System Quick I/O for Database Utility Information Discl (Symantec)