Symantec Multiple Products VRTSweb Code Execution

Publish date: July 21, 2015
  Severity: CRITICAL
  CVE Identifier: CVE-2009-3027
  Advisory Date: JUL 21, 2015

  DESCRIPTION

VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Protection Server (CPS) 11d, 12.0, and 12.5; Veritas NetBackup Operations Manager (NOM) 6.0 GA through 6.5.5; Veritas Backup Reporter (VBR) 6.0 GA through 6.6; Veritas Storage Foundation (SF) 3.5; Veritas Storage Foundation for Windows High Availability (SFWHA) 4.3MP2, 5.0, 5.0RP1a, 5.0RP2, 5.1, and 5.1AP1; Veritas Storage Foundation for High Availability (SFHA) 3.5; Veritas Storage Foundation for Oracle (SFO) 4.1, 5.0, and 5.0.1; Veritas Storage Foundation for DB2 4.1 and 5.0; Veritas Storage Foundation for Sybase 4.1 and 5.0; Veritas Storage Foundation for Oracle Real Application Cluster (SFRAC) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Manager (SFM) 1.0, 1.0 MP1, 1.1, 1.1.1Ux, 1.1.1Win, and 2.0; Veritas Cluster Server (VCS) 3.5, 4.0, 4.1, and 5.0; Veritas Cluster Server One (VCSOne) 2.0, 2.0.1, and 2.0.2; Veritas Application Director (VAD) 1.1 and 1.1 Platform Expansion; Veritas Cluster Server Management Console (VCSMC) 5.1, 5.5, and 5.5.1; Veritas Storage Foundation Cluster File System (SFCFS) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Cluster File System for Oracle RAC (SFCFS RAC) 5.0; Veritas Command Central Storage (CCS) 4.x, 5.0, and 5.1; Veritas Command Central Enterprise Reporter (CC-ER) 5.0 GA, 5.0 MP1, 5.0 MP1RP1, and 5.1; Veritas Command Central Storage Change Manager (CC-SCM) 5.0 and 5.1; and Veritas MicroMeasure 5.0 does not properly validate authentication requests, which allows remote attackers to trigger the unpacking of a WAR archive, and execute arbitrary code in the contained files, via crafted data to TCP port 14300.

  TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

  SOLUTION

  Trend Micro Deep Security DPI Rule Number: 1003901
  Trend Micro Deep Security DPI Rule Name: 1003901 - Symantec Multiple Products VRTSweb Code Execution

  AFFECTED SOFTWARE AND VERSION

  • symantec backup_exec_continuous_protection_server 11d
  • symantec backup_exec_continuous_protection_server 12.0
  • symantec backup_exec_continuous_protection_server 12.5
  • symantec veritas_application_director 1.1
  • symantec veritas_backup_exec 11d
  • symantec veritas_backup_exec 12.0
  • symantec veritas_backup_exec 12.5
  • symantec veritas_cluster_server 3.5
  • symantec veritas_cluster_server 4.0
  • symantec veritas_cluster_server 4.1
  • symantec veritas_cluster_server 5.0
  • symantec veritas_cluster_server_management_console 5.1
  • symantec veritas_cluster_server_management_console 5.5
  • symantec veritas_cluster_server_management_console 5.5.1
  • symantec veritas_cluster_server_one 2.0
  • symantec veritas_cluster_server_one 2.0.1
  • symantec veritas_cluster_server_one 2.0.2
  • symantec veritas_command_central_enterprise_reporter 5.0_ga
  • symantec veritas_command_central_enterprise_reporter 5.0mp1
  • symantec veritas_command_central_enterprise_reporter 5.0mp1rp1
  • symantec veritas_command_central_enterprise_reporter 5.1
  • symantec veritas_command_central_storage 4.x
  • symantec veritas_command_central_storage 5.0
  • symantec veritas_command_central_storage 5.1
  • symantec veritas_command_central_storage_change_manager 5.0
  • symantec veritas_command_central_storage_change_manager 5.1
  • symantec veritas_micromeasure 5.0
  • symantec veritas_netbackup_operations_manager 6.0_ga
  • symantec veritas_netbackup_operations_manager 6.5.5
  • symantec veritas_netbackup_reporter 6.0_ga
  • symantec veritas_netbackup_reporter 6.6
  • symantec veritas_storae_foundation 3.5_onwards
  • symantec veritas_storage_foundation 3.5
  • symantec veritas_storage_foundation_cluster_file_system 3.5
  • symantec veritas_storage_foundation_cluster_file_system 4.0
  • symantec veritas_storage_foundation_cluster_file_system 4.1
  • symantec veritas_storage_foundation_cluster_file_system 5.0
  • symantec veritas_storage_foundation_cluster_file_system_for_oracle_rac 5.0
  • symantec veritas_storage_foundation_for_db2 4.1
  • symantec veritas_storage_foundation_for_db2 5.0
  • symantec veritas_storage_foundation_for_high_availability 3.5
  • symantec veritas_storage_foundation_for_oracle 4.1
  • symantec veritas_storage_foundation_for_oracle 5.0
  • symantec veritas_storage_foundation_for_oracle 5.0.1
  • symantec veritas_storage_foundation_for_oracle_real_application_cluster 3.5
  • symantec veritas_storage_foundation_for_oracle_real_application_cluster 4.0
  • symantec veritas_storage_foundation_for_oracle_real_application_cluster 4.1
  • symantec veritas_storage_foundation_for_oracle_real_application_cluster 5.0
  • symantec veritas_storage_foundation_for_sybase 4.1
  • symantec veritas_storage_foundation_for_sybase 5.0
  • symantec veritas_storage_foundation_for_windows_high_availability 4.3mp2
  • symantec veritas_storage_foundation_for_windows_high_availability 5.0
  • symantec veritas_storage_foundation_for_windows_high_availability 5.0rp1a
  • symantec veritas_storage_foundation_for_windows_high_availability 5.0rp2
  • symantec veritas_storage_foundation_for_windows_high_availability 5.1
  • symantec veritas_storage_foundation_for_windows_high_availability 5.1ap1
  • symantec veritas_storage_foundation_manager 1.0
  • symantec veritas_storage_foundation_manager 1.0mp1
  • symantec veritas_storage_foundation_manager 1.1
  • symantec veritas_storage_foundation_manager 1.1.1ux
  • symantec veritas_storage_foundation_manager 1.1.1win
  • symantec veritas_storage_foundation_manager 2.0

Featured Stories