exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

SYM06-015_signed.txt

SYM06-015_signed.txt
Posted Aug 27, 2006
Site symantec.com

Symantec Security Advisory - Symantec discovered a security issue in Symantec's Veritas NetBackup 6.0 PureDisk Remote Office Edition. An unauthorized user with access to the network and the server hosting the management interface can potentially bypass the management interface authentication to gain access and elevate their privileges on the system.

tags | advisory, remote
SHA-256 | 8e974c7fc009ae3e7308711422221b19beca99e579c11126f553bda2721afcd1

SYM06-015_signed.txt

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Symantec Security Advisory

SYM06-015

16 August 2006

Symantec NetBackup PureDisk: Non-Privileged User Authentication Bypass
Elevation of
Privilege

Revision History
None

Severity
Medium (highly dependent on network configuration)

Remote Access
Yes
Local Access
No
Authentication Required
Yes (to network)
Exploit publicly available
No

Overview
Symantec discovered a security issue in Symantec's Veritas NetBackup 6.0
PureDisk Remote
Office Edition. An unauthorized user with access to the network and the
server hosting the
management interface can potentially bypass the management interface
authentication to gain
access and elevate their privileges on the system.

Supported Product(s) Affected
Product: Symantec Veritas NetBackup PureDisk Remote
Office Edition (all platforms)
Version: 6.0
Builds: GA, MP1
Solution: NB_PDE_60_MP1_P01

NOTE: For systems running NetBackup 6.0 GA PureDisk Remote Office Edition
it will be
necessary to install Maintenance Pack 1 prior to applying this Security
Pack.
This issue ONLY affects the product and versions listed above.

Details
An internal review revealed a potential elevation of privilege issue in the
Symantec Veritas
NetBackup PureDisk management interface. The management interface is
accessible only
through an SSL web connection by default. However it is possible for a
non-privileged user with
access to the network and the server hosting the Symantec Veritas NetBackup
PureDisk
management interface, to bypass the management interface authentication and
further leverage
their access to elevate privileged access on the server.

Symantec Response
Symantec engineers have addressed the issues identified above and made
Security updates
available.
Symantec strongly recommends all customers apply the latest security update
to protect against
threats of this nature.
Symantec knows of no exploitation of or adverse customer impact from these
issues.


The patches listed above for affected products are available through the
following location:
http://support.veritas.com/docs/284734 for Symantec Veritas NetBackup
PureDisk Remote
Office Edition.

Best Practices
As part of normal best practices, Symantec recommends:
- - Restrict access to administration or management systems to authorized
privileged users
only
- - Block remote access to all ports not essential for efficient operation
- - Restrict remote access, if required, to trusted/authorized systems only
- - Remove/disable unnecessary accounts or restrict access according to
security policy as
required
- - Run under the principle of least privilege where possible
- - Keep all operating systems and applications updated with the latest
vendor patches
- - Follow a multi-layered approach to security. Run both firewall and
antivirus applications,
at a minimum, to provide multiple points of detection and protection to
both inbound and
outbound threats
- - Deploy network intrusion detection systems to monitor network traffic for
signs of
anomalous or suspicious activity. This may aid in detection of attacks or
malicious
activity related to exploitation of latest vulnerabilities

CVE
A CVE Candidate name is being requested from the Common Vulnerabilities and
Exposures
(CVE) initiative for this issue. This advisory will be revised accordingly
upon receipt of the CVE
Candidate name.
This issue is a candidate for inclusion in the CVE list
(http://cve.mitre.org), which standardizes
names for security problems.









-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.6 (Build 6060)

iQEVAwUBRON2CBy6+gFWHby+AQhJAwf/dXuTHhkFJ+cqnVxFiDaBdpH0zkrb0zDU
H9d6txyy7kiFa8D8Ul2bVHT0fARLmkiCzOrdkOKujV/cIgORSGm5MaghJpOnz6mB
/eM7G/iv2AWfxjHVByDrWxnDP3+MQIBCLH+oix5TthcipHLOONoEK2NowJm/idoa
rkyDIzDLbx9zzikD89BwIn2BiR0DZFm8wpF4D3X0PTQFsh/klfy39LOjQgM/HDZN
mrNL9OQyTjif+L9SkGKGHgOavTOrVwZqn52u7a2D/RHTy7iWuFNpy1Md8yLa/hZg
Yhb3CLAHwAPFHz1d86rWscsu3ERLdGaKjgxoWFlKyKSVfaXGIxxzeA==
=+N1w
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close