VERITAS Storage Exec DCOM Server Buffer Overflows

SYMSA1069
Last Updated September 19, 2005
Initial Publication Date September 19, 2005
Copy Article Title/URL
Feedback
Subscribe
  • Status: Closed
  • Severity: Medium
  • CVSS Base Score: 7.5

Multiple VERITAS Storage Exec DCOM server components have been identified as susceptible to buffer overflows through calls to associated ActiveX controls. If properly exploited, this vulnerability could allow execution of remotely downloaded code on the system with privileges of the logged on user. Exploitation may result in a system crash, or potentially lead to access to the local system with privileges of the authenticated user.

Successful exploitation is highly dependent on user involvement for malicious code to gain initial access to the system

Risk Impact
Low

Remote Access

Yes (incoming mail)

Local Access

No

Authentication Required

No

Exploit publicly available

NA

 

Affected Supported Products

Product

Version

Build

Solution

Storage Exec

5.3

rev. 2190R

Hotfix 9

StorageCentral

5.2

rev. 322

Hotfix Q323003.ism Hot Fix 2


Legacy versions may also be affected.

Customers running earlier legacy versions should upgrade to the latest version indicated above and apply all current hotfixes.

Details
NGS Research identified multiple DCOM servers in VERITAS Storage Exec that are susceptible to stack and heap overflows as they fail to properly validate/parse external input. The buffer overflows in the DCOM servers can be successfully initiated by calls to associated ActiveX controls. To successfully launch this type of attack, the authenticated user would have had to either visit a hostile web site or be enticed to visit a hostile location where the malicious code could be successfully executed or downloaded to the local system. Or, the user would need to download an html email containing malicious code that could be successfully run on the system.

Exploiting this issue could result in a system crash or, if successful, could potentially result in access to the local system with authenticated user privileges.

The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CAN-2005-2996 to this issue. This issue is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems

 

Symantec Response
Symantec engineers have verified these issues and made security upgrades available for VERITAS Storage Exec 5.3 and StorageCentral 5.2. Symantec recommends customers immediately apply the latest hotfix update for their supported product versions to protect against these types of threats.

In a normal network deployment, VERITAS Storage Exec or Storage Central would be restricted to administrative positions, which would reduce target availability.

Product specific fixes are available from the following Support locations

VERITAS Storage Exec 5.3 rev 2190R - Hotfix 9
http://support.veritas.com/docs/277566

VERITAS StorageCentral 5.2 rev 322 - Hotfix Q323003.ism Hot Fix 2
http://support.veritas.com/docs/277567

Symantec is not aware of any exploit of or adverse customer impact from these issues.

As normal best practices, Symantec strongly recommends:
 

  • Restricting access to administration or management systems to privileged users only with additional restricted access to the physical host system(s) if possible.
  • Running under the principle of least privilege where possible to limit the impact of exploit by threats such as this.
  • Keeping all operating systems and applications updated with the latest vendor patches.
  • Following a multi-layered approach to security. Run both firewall and antivirus applications, at a minimum to provide multiple points of detection and protection to both inbound and outbound threats.
  • Being cautious of mysterious attachments and executables delivered via email and cautious of visiting unknown/untrusted websites or executing unknown URL links.
  • Not opening unidentified attachments or executables from unknown sources or that you didn't request or were unaware of. Always err on the side of caution. Even if the sender is known, the source address may be spoofed.
  • If in doubt, contact the sender to confirm they sent it and why before opening the attachment. If still in doubt, delete the attachment without opening it.

Symantec would like to thank NGS Research’s Mark Litchfield, for identifying and reporting this issue and providing coordination while Symantec resolved the issue

Revision History
Revision 1 - 9/23/2005, CVE Candidate CAN-2005-2996 assigned to this issue.

Legacy ID: SYM05-014

Thanks for your feedback. Let us know if you have additional comments below. (requires login)

    © 1995-2019 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.