TITLE: VERITAS NetBackup "vmd" Shared Library Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA17503 VERIFY ADVISORY: http://secunia.com/advisories/17503/ CRITICAL: Moderately critical IMPACT: DoS, System access WHERE: >From local network SOFTWARE: VERITAS NetBackup Enterprise Server 5.x http://secunia.com/product/4121/ DESCRIPTION: A vulnerability has been reported in VERITAS NetBackup, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a vulnerable system. The vulnerability is caused due to a boundary error in a shared library used by the vmd (Volume Manager Daemon). This can be exploited to cause a DoS by disrupting the backup process and potentially to execute arbitrary code on an affected system via the vmd daemon. The vulnerability has been reported in NetBackup Enterprise Server Server/Client version 5.0 and 5.1. Note: The vulnerability may also affect other daemons that use the affected shared library. SOLUTION: Apply cumulative security packs. http://support.veritas.com/menu_ddProduct_NBUESVR_view_DOWNLOAD.htm NetBackup Enterprise Server Server/Client 5.0: Apply NB_50_5S2_M. NetBackup Enterprise Server Server/Client 5.1: Apply NB_51_3AS2_M. PROVIDED AND/OR DISCOVERED BY: The vendor credits iDEFENSE. ORIGINAL ADVISORY: Symantec: http://securityresponse.symantec.com/avcenter/security/Content/2005.11.08b.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------