Input validation error in Backup Exec - CVE-2011-0546
Published: May 31, 2011 / Updated: August 11, 2020
Vulnerability identifier: #VU45012
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2011-0546
CWE-ID: CWE-20
Exploitation vector: Adjecent network
Exploit availability:
Public exploit is available
Vendor: Veritas Technologies
Affected software:
Backup Exec
Backup Exec
Detailed vulnerability description
The vulnerability allows a remote #AU# to execute arbitrary code.
Symantec Backup Exec 11.0, 12.0, 12.5, 13.0, and 13.0 R2 does not validate identity information sent between the media server and the remote agent, which allows man-in-the-middle attackers to execute NDMP commands via unspecified vectors.
How to mitigate CVE-2011-0546
Install update from vendor's website.
Sources
- http://marc.info/?l=bugtraq&m=131489365508507&w=2
- http://secunia.com/advisories/44698
- http://securityreason.com/securityalert/8300
- http://www.securityfocus.com/bid/47824
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110526_00