Related information

Multiple Veritas Backup Exec backup solutions vulnerabilities

US-CERT Technical Cyber Security Alert TA05-180A -- VERITAS Backup Exec Software is actively being exploited

[VulnWatch] iDEFENSE Security Advisory 06.23.05: Veritas Backup Exec Server Remote Registry Access Vulnerability

[VulnWatch] Veritas Backup Exec Remote Agent NDMLSRVR.DLL DoS Vulnerability: Veritas Backup Exec Remote Agent NDMLSRVR.DLL DoS Vulnerability

[VulnWatch] iDEFENSE Security Advisory 06.23.05: Veritas Backup Exec Agent Error Status Remote DoS Vulnerability

From:	Mark Litchfield <mark_(at)_ngssoftware.com>
Date:	24.06.2005
Subject:	[VulnWatch] Buffer overflow vulnerability in VERITAS Software Backup Exec Web Administration Console (BEWAC)

Mark Litchfield of NGSSoftware has discovered a high risk vulnerability in
the
in VERITAS Software Backup Exec Web Administration Console (BEWAC) which can
allow
for remote code execution.

Affected Products include -
Backup Exec 10.0 for Windows Servers rev. 5484
Backup Exec 9.1 for Windows Servers rev. 4691
Backup Exec 9.0 for Windows Servers rev. 4454
Backup Exec 9.0 for Windows Servers rev. 4367

A Patch can be obtained from -
http://seer.support.veritas.com/docs/276606.htm

NGSSoftware are going to withhold details of this flaw for three months.
Full details will be published on the 23rd September 2005. This three month
window will allow users of Veritas Backup Exec Server the time needed to
apply the patch
before the details are released to the general public. This reflects
NGSSoftware's approach to responsible disclosure.

NGSSoftware Insight Security Research
http://www.ngssoftware.com
http://www.databasesecurity.com/
+44(0)208 401 0070