NVD Vulnerability Detail
Search Exploit, PoC
CVE-2009-3027
Summary

VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Protection Server (CPS) 11d, 12.0, and 12.5; Veritas NetBackup Operations Manager (NOM) 6.0 GA through 6.5.5; Veritas Backup Reporter (VBR) 6.0 GA through 6.6; Veritas Storage Foundation (SF) 3.5; Veritas Storage Foundation for Windows High Availability (SFWHA) 4.3MP2, 5.0, 5.0RP1a, 5.0RP2, 5.1, and 5.1AP1; Veritas Storage Foundation for High Availability (SFHA) 3.5; Veritas Storage Foundation for Oracle (SFO) 4.1, 5.0, and 5.0.1; Veritas Storage Foundation for DB2 4.1 and 5.0; Veritas Storage Foundation for Sybase 4.1 and 5.0; Veritas Storage Foundation for Oracle Real Application Cluster (SFRAC) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Manager (SFM) 1.0, 1.0 MP1, 1.1, 1.1.1Ux, 1.1.1Win, and 2.0; Veritas Cluster Server (VCS) 3.5, 4.0, 4.1, and 5.0; Veritas Cluster Server One (VCSOne) 2.0, 2.0.1, and 2.0.2; Veritas Application Director (VAD) 1.1 and 1.1 Platform Expansion; Veritas Cluster Server Management Console (VCSMC) 5.1, 5.5, and 5.5.1; Veritas Storage Foundation Cluster File System (SFCFS) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Cluster File System for Oracle RAC (SFCFS RAC) 5.0; Veritas Command Central Storage (CCS) 4.x, 5.0, and 5.1; Veritas Command Central Enterprise Reporter (CC-ER) 5.0 GA, 5.0 MP1, 5.0 MP1RP1, and 5.1; Veritas Command Central Storage Change Manager (CC-SCM) 5.0 and 5.1; and Veritas MicroMeasure 5.0 does not properly validate authentication requests, which allows remote attackers to trigger the unpacking of a WAR archive, and execute arbitrary code in the contained files, via crafted data to TCP port 14300.

Publication Date Dec. 12, 2009, 1:30 a.m.
Registration Date Jan. 29, 2021, 1:22 p.m.
Last Update Oct. 11, 2018, 4:42 a.m.
CVSS2.0 : HIGH
Score 10.0
Vector AV:N/AC:L/Au:N/C:C/I:C/A:C
攻撃元区分(AV) ネットワーク
攻撃条件の複雑さ(AC)
攻撃前の認証要否(Au) 不要
機密性への影響(C)
完全性への影響(I)
可用性への影響(A)
Get all privileges. いいえ
Get user privileges いいえ
Get other privileges いいえ
User operation required いいえ
Affected software configurations
Configuration1 or higher or less more than less than
cpe:2.3:a:symantec:backup_exec_continuous_protection_server:11d:*:*:*:*:*:*:*
cpe:2.3:a:symantec:backup_exec_continuous_protection_server:12.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:backup_exec_continuous_protection_server:12.5:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_application_director:1.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_application_director:1.1:*:platform_expansion:*:*:*:*:*
cpe:2.3:a:symantec:veritas_backup_exec:11d:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_backup_exec:12.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_backup_exec:12.5:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server:3.5:*:hp-ux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server:4.0:*:aix:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server:4.0:*:linux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server:4.1:*:hp-ux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server:4.1:*:linux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server:4.1:*:solaris:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server:5.0:*:aix:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server:5.0:*:hp-ux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server:5.0:*:linux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server:5.0:*:solaris:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server_management_console:5.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server_management_console:5.5:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server_management_console:5.5.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server_one:2.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server_one:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_cluster_server_one:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_command_central_enterprise_reporter:5.0_ga:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_command_central_enterprise_reporter:5.0mp1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_command_central_enterprise_reporter:5.0mp1rp1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_command_central_enterprise_reporter:5.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_command_central_storage:4.x:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_command_central_storage:5.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_command_central_storage:5.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_command_central_storage_change_manager:5.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_command_central_storage_change_manager:5.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_micromeasure:5.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_netbackup_operations_manager:6.0_ga:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_netbackup_operations_manager:6.5.5:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_netbackup_reporter:6.0_ga:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_netbackup_reporter:6.6:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storae_foundation:3.5_onwards:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation:3.5:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:3.5:*:hp-ux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:4.0:*:aix:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:4.0:*:hp-ux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:4.0:*:linux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:4.0:*:solaris:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:4.1:*:aix:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:4.1:*:hp-ux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:4.1:*:linux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:4.1:*:solaris:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:5.0:*:aix:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:5.0:*:hp-ux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:5.0:*:linux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system:5.0:*:solaris:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_cluster_file_system_for_oracle_rac:5.0:*:linux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_db2:4.1:*:linux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_db2:4.1:*:solaris:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_db2:5.0:*:aix:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_db2:5.0:*:linux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_db2:5.0:*:solaris:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_high_availability:3.5:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle:4.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle:5.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle_real_application_cluster:3.5:*:hp-ux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle_real_application_cluster:4.0:*:aix:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle_real_application_cluster:4.0:*:linux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle_real_application_cluster:4.1:*:linux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle_real_application_cluster:4.1:*:solaris:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle_real_application_cluster:4.1:hp-ux:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle_real_application_cluster:5.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle_real_application_cluster:5.0:*:aix:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle_real_application_cluster:5.0:*:hp-ux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle_real_application_cluster:5.0:*:linux:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_oracle_real_application_cluster:5.0:*:solaris:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_sybase:4.1:*:solaris:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_sybase:5.0:*:solaris:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_windows_high_availability:4.3mp2:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_windows_high_availability:5.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_windows_high_availability:5.0rp1a:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_windows_high_availability:5.0rp2:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_windows_high_availability:5.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_for_windows_high_availability:5.1ap1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_manager:1.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_manager:1.0mp1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_manager:1.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_manager:1.1.1ux:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_manager:1.1.1win:*:*:*:*:*:*:*
cpe:2.3:a:symantec:veritas_storage_foundation_manager:2.0:*:*:*:*:*:*:*
Related information, measures and tools
Common Vulnerabilities List

JVN Vulnerability Information
複数の Symantec 製品の VRTSweb における任意のコードを実行される脆弱性
Title 複数の Symantec 製品の VRTSweb における任意のコードを実行される脆弱性
Summary

複数の Symantec 製品の VRTSweb には、認証リクエストを適切に検証しないため、任意のコードを実行される脆弱性が存在します。

Possible impacts 巧妙に細工された TCP ポート 14300 のデータにより、任意のコードを実行される可能性があります。
Solution

ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。

Publication Date Dec. 8, 2009, midnight
Registration Date Feb. 1, 2010, 11:51 a.m.
Last Update Feb. 1, 2010, 11:51 a.m.
Affected System
ヒューレット・パッカード
HP-UX 11.22
HP-UX 11.31
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
その他
Change Log
No Changed Details Date of change
0 [2010年02月01日]
  掲載
Feb. 17, 2018, 10:37 a.m.