CVE-2007-2361
Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore points images are configured, uses weak permissions (world readable) for a configuration file with network…
Does this matter?
Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.
Description
Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore points images are configured, uses weak permissions (world readable) for a configuration file with network share credentials, which allows local users to obtain the credentials by reading the file.
- CVSS 2.0
- 4.9 MEDIUMAV:L/AC:L/Au:N/C:C/I:N/A:N
- EPSS
- 0.34% probability · 28th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Affected
- symantec/backupexec system recovery · symantec/livestate recovery · symantec/norton ghost · symantec/norton save and recovery
- Source
- cve@mitre.org
EPSS 0.3% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=520Vendor Advisory
- http://secunia.com/advisories/25013
- http://www.securitytracker.com/id?1017971
- http://www.symantec.com/avcenter/security/Content/2007.04.26.htmlPatch, Vendor Advisory
- http://www.vupen.com/english/advisories/2007/1552
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33929
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=520Vendor Advisory
- http://secunia.com/advisories/25013
- http://www.securitytracker.com/id?1017971
- http://www.symantec.com/avcenter/security/Content/2007.04.26.htmlPatch, Vendor Advisory
- http://www.vupen.com/english/advisories/2007/1552
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33929
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.