----------------------------------------------------------------------

Secunia Network Software Inspector 2.0 (NSI) - Public Beta

The Public Beta has ended. Thanks to all that participated.

Learn more:
http://secunia.com/network_software_inspector_2/

----------------------------------------------------------------------

TITLE:
Symantec Backup Exec System Recovery Manager Directory Traversal

SECUNIA ADVISORY ID:
SA30432

VERIFY ADVISORY:
http://secunia.com/advisories/30432/

CRITICAL:
Moderately critical

IMPACT:
Exposure of sensitive information, System access

WHERE:
>From local network

SOFTWARE:
Symantec Backup Exec System Recovery 7.x
http://secunia.com/product/17451/
Symantec Backup Exec System Recovery 8.x
http://secunia.com/product/18844/

DESCRIPTION:
A vulnerability has been reported in Symantec Backup Exec System
Recovery Manager, which can be exploited by malicious people to
disclose potentially sensitive information and potentially compromise
a vulnerable system.

The vulnerability is caused due to an input validation error and can
be exploited to e.g. read certain system files and gain unauthorized
access to the vulnerable system via directory traversal attacks.

The vulnerability is reported in versions 7.x and 8.x.

SOLUTION:
Update to version 7.0.4 or 8.0.2.
https://fileconnect.symantec.com/

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Nicolas Pouvesle, Tenable Security.

ORIGINAL ADVISORY:
SYM08-013:
http://securityresponse.symantec.com/avcenter/security/Content/2008.05.28c.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------