bugtraq - BID 14355, VERITAS NetBackup 5.1 Time Stamp Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 9 Aug 2005 20:09:43 -0000
From: secure@...antec.com
To: bugtraq@...urityfocus.com
Subject: BID 14355, VERITAS NetBackup 5.1 Time Stamp Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Reference:  BID 14355, http://www.securityfocus.com/bid/14355, 

Risk:  Very Low to minimal

Affected product:  Veritas NetBackup minimal impact only

This issue does NOT affect Veritas Backup Exec 

Symantec engineers have thoroughly reviewed the issue as posted to
the bugtraq mailing list.  

Passing a CONFIG request with a malformed timestamp in the ndmpheader
does result in a segment fault killing the current listening process
spawned when the connection attempt is made.  However, the only
process affected is the child process spawned separately for each
connection attempt by the underlying agent.  The agent is NOT
impacted and will continue to spawn processes to handle additional
connection requests as they are received.  Although this minor issue
causes no functionality problems with the product, Symantec engineers
are reviewing options to address it in future updates.

Symantec takes the security of our products seriously and adheres to
responsible disclosure. Our response policy and pgp key for secure
communications are available from http://www.symantec.com/security
<http://www.symantec.com/security>. 

Symantec will work responsibly with anyone who believes they have
found a security issue in a Symantec product to validate the problem
and coordinate any response deemed necessary.

Please contact secure (at) symantec (dot) com concerning security
issues with Symantec products.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQA/AwUBQvkPupIF/uvuJQrOEQI90ACeIy4dEs9FkPQprGX59D3oQE6HJm0AoLve
yO0IRcuEJt5g6JLU+e8dtSx7
=arj9
-----END PGP SIGNATURE-----