Secunia

Some vulnerabilities have been reported in Symantec Backup Exec for Windows Servers, which can be exploited by malicious people to bypass certain security restrictions and by malicious users to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

1) Multiple errors in several authentication methods used by a Backup Exec Remote Agent can be exploited to gain unauthorized access to the application and e.g. read or delete arbitrary files.

2) An unspecified error in the data management protocol can be exploited to cause a buffer overflow.

Successful exploitation of this vulnerability may allow execution of arbitrary code, but requires that the attacker is authenticated as a privileged user (the required privileges can also be gained by exploiting vulnerability #1).

The vulnerabilities are reported in the following versions:
* Backup Exec for Windows Servers version 12.5 build 2213
* Backup Exec for Windows Servers version 12.0 build 1364
* Backup Exec for Windows Servers version 11d build 7170
* Backup Exec for Windows Servers version 11d build 6235

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Renaud Deraison and Nicolas Pouvesle of Tenable Network Security.

Changelog
Further details available in Customer Area

Original Advisory
Symantec (SYM08-021):
http://securityresponse.symantec.com/avcenter/security/Content/2008.11.19.html

Deep Links
Links available in Customer Area