CVE-2009-3027
Description
VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Protection Server (CPS) 11d, 12.0, and 12.5; Veritas NetBackup Operations Manager (NOM) 6.0 GA through 6.5.5; Veritas Backup Reporter (VBR) 6.0 GA through 6.6; Veritas Storage Foundation (SF) 3.5; Veritas Storage Foundation for Windows High Availability (SFWHA) 4.3MP2, 5.0, 5.0RP1a, 5.0RP2, 5.1, and 5.1AP1; Veritas Storage Foundation for High Availability (SFHA) 3.5; Veritas Storage Foundation for Oracle (SFO) 4.1, 5.0, and 5.0.1; Veritas Storage Foundation for DB2 4.1 and 5.0; Veritas Storage Foundation for Sybase 4.1 and 5.0; Veritas Storage Foundation for Oracle Real Application Cluster (SFRAC) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Manager (SFM) 1.0, 1.0 MP1, 1.1, 1.1.1Ux, 1.1.1Win, and 2.0; Veritas Cluster Server (VCS) 3.5, 4.0, 4.1, and 5.0; Veritas Cluster Server One (VCSOne) 2.0, 2.0.1, and 2.0.2; Veritas Application Director (VAD) 1.1 and 1.1 Platform Expansion; Veritas Cluster Server Management Console (VCSMC) 5.1, 5.5, and 5.5.1; Veritas Storage Foundation Cluster File System (SFCFS) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Cluster File System for Oracle RAC (SFCFS RAC) 5.0; Veritas Command Central Storage (CCS) 4.x, 5.0, and 5.1; Veritas Command Central Enterprise Reporter (CC-ER) 5.0 GA, 5.0 MP1, 5.0 MP1RP1, and 5.1; Veritas Command Central Storage Change Manager (CC-SCM) 5.0 and 5.1; and Veritas MicroMeasure 5.0 does not properly validate authentication requests, which allows remote attackers to trigger the unpacking of a WAR archive, and execute arbitrary code in the contained files, via crafted data to TCP port 14300.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| symantec backup_exec_continuous_protection_server | 11d, 12.0, 12.5 | — |
| symantec veritas_application_director | 1.1 | — |
| symantec veritas_backup_exec | 11d, 12.0, 12.5 | — |
| symantec veritas_cluster_server | 3.5, 4.0, 4.1, 5.0 | — |
| symantec veritas_cluster_server_management_console | 5.1, 5.5, 5.5.1 | — |
| symantec veritas_cluster_server_one | 2.0, 2.0.1, 2.0.2 | — |
| symantec veritas_command_central_enterprise_reporter | 5.0_ga, 5.0mp1, 5.0mp1rp1, 5.1 | — |
| symantec veritas_command_central_storage | 4.x, 5.0, 5.1 | — |
| symantec veritas_command_central_storage_change_manager | 5.0, 5.1 | — |
| symantec veritas_micromeasure | 5.0 | — |
| symantec veritas_netbackup_operations_manager | 6.0_ga, 6.5.5 | — |
| symantec veritas_netbackup_reporter | 6.0_ga, 6.6 | — |
| symantec veritas_storae_foundation | 3.5_onwards | — |
| symantec veritas_storage_foundation | 3.5 | — |
| symantec veritas_storage_foundation_cluster_file_system | 3.5, 4.0, 4.1, 5.0 | — |
| symantec veritas_storage_foundation_cluster_file_system_for_oracle_rac | 5.0 | — |
| symantec veritas_storage_foundation_for_db2 | 4.1, 5.0 | — |
| symantec veritas_storage_foundation_for_high_availability | 3.5 | — |
| symantec veritas_storage_foundation_for_oracle | 4.1, 5.0, 5.0.1 | — |
| symantec veritas_storage_foundation_for_oracle_real_application_cluster | 3.5, 4.0, 4.1, 5.0 | — |
| symantec veritas_storage_foundation_for_sybase | 4.1, 5.0 | — |
| symantec veritas_storage_foundation_for_windows_high_availability | 4.3mp2, 5.0, 5.0rp1a, 5.0rp2, 5.1, 5.1ap1 | — |
| symantec veritas_storage_foundation_manager | 1.0, 1.0mp1, 1.1, 1.1.1ux, 1.1.1win, 2.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.