Vulnerability Note VU#213697

Symantec Backup Exec contains heap overflow in RPC interface

Overview

Symantec Backup Exec for Windows Servers contains a vulnerability that may allow a remote attacker to cause a denial of service or potentially execute arbitrary code on an affected system.

I. Description

Symantec Backup Exec for Windows Servers is a client/server based backup software solution. A heap buffer overflow vulnerability exists in the way one of the Remote Procedure Call (RPC) interfaces provided by this software handles requests using the ncacn_ip_tcp protocol. A remote attacker with the ability to connect to the affected service and supply a specially crafted packet could exploit this vulnerability.

II. Impact

A remote unauthenticated attacker may be able to cause the affected service to crash, resulting in a denial of service. Symantec reports that the attacker may also potentially be able to execute arbitrary code on the affected system.

III. Solution

Apply an update from the vendor

Symantec has published Symantec Security Advisory SYM07-015 in response to this issue. Users are encouraged to review this advisory and apply the patches it refers to.

Workarounds
You may wish to block access to the vulnerable software from outside your network perimeter, specifically by blocking access to the ports used by the affected component (6106/tcp). This will limit your exposure to attacks. However, blocking at the network perimeter would still allow attackers within the perimeter of your network to exploit the vulnerability. The use of host-based firewalls in addition to network-based firewalls can help restrict access to specific hosts within the network. It is important to understand your network's configuration and service requirements before deciding what changes are appropriate.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Symantec, Inc.	Vulnerable	11-Jul-2007

References

http://www.symantec.com/avcenter/security/Content/2007.07.11a.html

Credit

iDefense reported this vulnerability in iDefense PUBLIC ADVISORY: 07.11.07. They credit an anonymous researcher with reporting this vulnerability to them.

This document was written by Chad R Dougherty based on information supplied by Symantec and iDefense.

Other Information

Date Public:	2007-07-11
Date First Published:	2007-07-11
Date Last Updated:	2007-07-11
CERT Advisory:
CVE-ID(s):	CVE-2007-3509
NVD-ID(s):	CVE-2007-3509
US-CERT Technical Alerts:
Metric:	6.30
Document Revision:	4

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2007 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader