CVE-2008-3703
The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (SFW) 5.0, 5.0 RP1a, and 5.1 accepts NULL NTLMSSP authentication, which allows remote attackers to execute…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 12.2%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (SFW) 5.0, 5.0 RP1a, and 5.1 accepts NULL NTLMSSP authentication, which allows remote attackers to execute arbitrary code via requests to the service socket that create "snapshots schedules" registry values specifying future command execution. NOTE: this issue exists because of an incomplete fix for CVE-2007-2279.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 12.25% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- symantec/veritas storage foundation
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/31486Vendor Advisory
- http://securityreason.com/securityalert/4161
- http://securitytracker.com/id?1020699
- http://seer.entsupport.symantec.com/docs/306386.htmPatch
- http://www.securityfocus.com/archive/1/495481
- http://www.securityfocus.com/archive/1/495487/100/0/threaded
- http://www.securityfocus.com/bid/30596
- http://www.symantec.com/avcenter/security/Content/2008.08.14a.html
- http://www.vupen.com/english/advisories/2008/2395
- http://www.zerodayinitiative.com/advisories/ZDI-08-053/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44466
- http://secunia.com/advisories/31486Vendor Advisory
- http://securityreason.com/securityalert/4161
- http://securitytracker.com/id?1020699
- http://seer.entsupport.symantec.com/docs/306386.htmPatch
- http://www.securityfocus.com/archive/1/495481
- http://www.securityfocus.com/archive/1/495487/100/0/threaded
- http://www.securityfocus.com/bid/30596
- http://www.symantec.com/avcenter/security/Content/2008.08.14a.html
- http://www.vupen.com/english/advisories/2008/2395
- http://www.zerodayinitiative.com/advisories/ZDI-08-053/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44466
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.