CVE-2008-5408
Buffer overflow in the data management protocol in Symantec Backup Exec for Windows Servers 11.0 (aka 11d) builds 6235 and 7170, 12.0 build 1364, and 12.5 build 2213 allows remote authenticated users to cause a denial of service (application crash) and…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer overflow in the data management protocol in Symantec Backup Exec for Windows Servers 11.0 (aka 11d) builds 6235 and 7170, 12.0 build 1364, and 12.5 build 2213 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via unknown vectors. NOTE: this can be exploited by unauthenticated remote attackers by leveraging CVE-2008-5407.
- CVSS 2.0
- 9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C
- EPSS
- 4.48% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- symantec/backup exec for windows server
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/32810Vendor Advisory
- http://securityresponse.symantec.com/avcenter/security/Content/2008.11.19.htmlPatch, Vendor Advisory
- http://seer.entsupport.symantec.com/docs/314528.htmPatch, Vendor Advisory
- http://www.securityfocus.com/bid/32346Patch
- http://www.securitytracker.com/id?1021246
- http://www.vupen.com/english/advisories/2008/3209
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46731
- http://secunia.com/advisories/32810Vendor Advisory
- http://securityresponse.symantec.com/avcenter/security/Content/2008.11.19.htmlPatch, Vendor Advisory
- http://seer.entsupport.symantec.com/docs/314528.htmPatch, Vendor Advisory
- http://www.securityfocus.com/bid/32346Patch
- http://www.securitytracker.com/id?1021246
- http://www.vupen.com/english/advisories/2008/3209
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46731
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.