06 June 2007, 08:31
Hole in Symantec's Storage Foundation allows malicious code execution
Security service provider TippingPoint has discovered a vulnerability in Symantec's (Veritas) Storage Foundation that can allow attackers to manipulate the system and execute arbitrary code. The problem is a lack of authentication for the Windows Scheduler Service (VxSchedService.exe). As a result, everyone can connect to the service on Port 4888 via the local network. Furthermore, TippingPoint says it is also possible to change, rewrite, and add arbitrary commands to the registry key HKEY_LOCAL_MACHINE\Software\Veritas\VxSvc\CurrentVersion\Schedules which can be executed when a manipulated schedule entry becomes due. Only Symantec's Storage Foundation for Windows 5.0 is affected. An update has been provided to remedy the flaw.
- _ Symantec Veritas Storage Foundation Scheduler Service Authentication Bypass Vulnerability_, TippingPoint's security advisory
- _Symantec Storage Foundation for Windows Volume Manager: Authentication Bypass and Potential Code Execution in Scheduler Service_, Symantec's security advisory
(mba)
Print Version | Send by email
| Permalink: http://h-online.com/-732999
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
