bugtraq - Buffer overflow vulnerability in VERITAS Software Backup Exec Web Administration Console (BEWAC)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <002101c5780a$2e72d1d0$1b01010a@Nicky>
Date: Thu, 23 Jun 2005 16:42:37 +0100
From: "NGSSoftware Insight Security Research" <mark@...software.com>
To: <ntbugtraq@...tserv.ntbugtraq.com>, <vulnwatch@...nwatch.org>,
	<bugtraq@...urityfocus.com>
Subject: Buffer overflow vulnerability in VERITAS Software Backup Exec Web Administration Console (BEWAC)

Mark Litchfield of NGSSoftware has discovered a high risk vulnerability in 
the
in VERITAS Software Backup Exec Web Administration Console (BEWAC) which can 
allow
for remote code execution.

Affected Products include -
Backup Exec 10.0 for Windows Servers rev. 5484
Backup Exec 9.1 for Windows Servers rev. 4691
Backup Exec 9.0 for Windows Servers rev. 4454
Backup Exec 9.0 for Windows Servers rev. 4367

A Patch can be obtained from - 
http://seer.support.veritas.com/docs/276606.htm

NGSSoftware are going to withhold details of this flaw for three months.
Full details will be published on the 23rd September 2005. This three month
window will allow users of Veritas Backup Exec Server the time needed to 
apply the patch
before the details are released to the general public. This reflects
NGSSoftware's approach to responsible disclosure.

NGSSoftware Insight Security Research
http://www.ngssoftware.com
http://www.databasesecurity.com/
+44(0)208 401 0070