Insecure Password Storage in Symantec Norton Ghost and Related Products

CVE-2007-2361

Summary

The products from Symantec, including Norton Ghost and related backup tools, exhibit a critical vulnerability due to weak permissions set on a configuration file containing network share credentials. This vulnerability occurs when remote backups of restore point images are configured, granting local users the ability to read the file and obtain sensitive credentials. This misconfiguration leads to unauthorized access, putting the integrity of the backup process at risk and potentially compromising the security of the system.

References