Stack-Based Buffer Overflow in Symantec Backup Exec for Windows Server

CVE-2007-6016

Summary

The ActiveX control PVATLCalendar.PVCalendar.1 in pvcalendar.ocx, found within the scheduler component of Symantec Backup Exec for Windows Server, is susceptible to multiple stack-based buffer overflow vulnerabilities. Remote attackers can exploit these weaknesses by sending specially crafted inputs to various properties, specifically during the execution of the Save method. Although the vendor indicates that authenticated user involvement is required, this is misleading as no authentication is needed for an attacker to compromise client machines running this control, potentially allowing for arbitrary code execution.

References