Remote Code Execution Vulnerability in Symantec Backup Exec and Veritas Products
CVE-2009-3027

Currently unrated

Key Information:

Vendor
Symantec
Status
Veritas Cluster Server One
Veritas Storage Foundation For Oracle Real Application Cluster
Veritas Storage Foundation Cluster File System
Veritas Storage Foundation Manager
Vendor
CVE Published:
11 December 2009

Summary

The vulnerability identified in VRTSweb.exe allows attackers to exploit improper validation of authentication requests. By sending crafted data to TCP port 14300, a remote attacker can initiate the unpacking of a WAR archive, enabling the execution of arbitrary code contained within the files. This affects several products in the Symantec Backup Exec and Veritas line, particularly impacting server management and backup functionalities. Organizations using the affected versions should prioritize applying updates and patches to mitigate the risk of unauthorized code execution and potential data breaches.

References

http://marc.info/?l=bugtraq&m=126046186917330&w=2
vendor-advisoryx_refsource_HP
http://seer.entsupport.symantec.com/docs/337930.htm
x_refsource_CONFIRM
http://www.zerodayinitiative.com/advisories/ZDI-09-098/
x_refsource_MISC

EPSS Score

43% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.