CVE-2007-2360

Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore point images are configured, encrypt network share credentials with a key formed by a hash of the username, which allows local users to obtain the...

CVE-2007-2360

CVE-2007-2360 affects Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery prior to 20070426. When remote backups of restore point images are configured, network share credentials are encrypted with a key formed by a hash of the username, allowing loca...

CVE-2007-2361

CVE-2007-2361 affects Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery and BackupExec System Recovery prior to 20070426. When remote backups of restore points are configured, a configuration file containing network share credentials is world-readable, allowing local users to read...

CVE-2007-2359

CVE-2007-2359 concerns a buffer overflow in Ghost Service Manager used by Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery and BackupExec System Recovery prior to 20070426. The vulnerability arises from handling of a long string, enabling local users to gain privileges (local pri...

CVE-2007-2359

Buffer overflow in Ghost Service Manager, as used in Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, allows local users to gain privileges via a long string...

CVE-2007-2360

Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore point images are configured, encrypt network share credentials with a key formed by a hash of the username, which allows local users to obtain the...

CVE-2007-2361

Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore points images are configured, uses weak permissions world readable for a configuration file with network share credentials, which allows local users to...

CVE-2007-2375: Undefined Security Weakness

The agent remote upgrade interface in Symantec Enterprise Security Manager ESM before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol...

CVE-2007-2361: Undefined Security Weakness

Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore points images are configured, uses weak permissions world readable for a configuration file with network share credentials, which allows local users to...

CVE-2007-2359: Undefined Security Weakness

Buffer overflow in Ghost Service Manager, as used in Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, allows local users to gain privileges via a long string...

CVE-2007-2360: Undefined Security Weakness

Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore point images are configured, encrypt network share credentials with a key formed by a hash of the username, which allows local users to obtain the...

Symantec Norton Ghost本地溢出及信息泄露漏洞

Symantec Norton Ghost是一个备份恢复系统，允许用户将系统恢复到之前的快照状态。 Norton Ghost的服务管理器实现上存在缓冲区溢出漏洞，如果攻击者能够向Norton Ghost的服务管理器中的函数提供超长字符串的话，就可能触发缓冲区溢出，导致以系统级权限执行任意指令。 Norton...

Symantec Norton Ghost multiple security vulnerabilities

Service Manager buffer oveflow, weak encryption...

iDefense Security Advisory 04.26.07: Symantec Norton Ghost 10 Service Manager Buffer Overflow Vulnerability

Symantec Norton Ghost 10 Service Manager Buffer Overflow Vulnerability iDefense Security Advisory 04.26.07 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 26, 2007 I. BACKGROUND Symantec Norton Ghost is a backup and recovery application designed to allow users to completely restore the...

iDefense Security Advisory 04.26.07: Symantec Norton Ghost 10 Recovery Points Insecure Password Storage Vulnerability

Symantec Norton Ghost 10 Recovery Points Insecure Password Storage Vulnerability iDefense Security Advisory 04.26.07 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 26, 2007 I. BACKGROUND Symantec Norton Ghost is a backup and recovery application designed to allow users to completely...

SYMSA-2007-003 Macrovision InstallAnywhere Password and Serial Number Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Symantec Vulnerability Research http://www.symantec.com/research Security Advisory Advisory ID: SYMSA-2007-003 Advisory Title: Macrovision InstallAnywhere Password and Serial Number Bypass Author: Brian Reilly / [email protected] Release Date:...

Symantec Enterprise Security Manager远程升级远程代码执行漏洞

Symantec Enterprise Security Manager ESM可以在整个企业范围内为关键性应用程序和服务器自动搜索发现其漏洞隐患和不符合安全策略的设定。 Symantec Enterprise Security Manager存在设计问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 问题存在于ESM代理端的远程升级接口中，ESM代理端接收从熟悉升级协议的任意实体上的升级请求，并没有对源头进行任何可信认证。熟悉代理端协议的攻击者可以以应用程序进程权限执行任意指令。ESM代理端一般以管理员权限执行。 Symantec Enterprise Security...

Symantec Enterprise Security Manager Remote Upgrade Authentication Bypass

SUMMARY Symantec Enterprise Security Manager is susceptible to a remote code execution vulnerability. Severity High Remote | Yes ---|--- Local Access | Yes Authentication Required | No Exploit publicly available | No AFFECTED PRODUCTS Vulnerable Products The following supported ESM agent and...

Solaris 8 (sparc) : 115217-05

Version 4.0 of Volume Manager on the remote Solaris 8 host is missing security patch 115217-05 for package VRTSvxvm. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid24984; scriptversion"1.13";...

Solaris 8 (sparc) : 119009-11

VERITAS NetBackup 6.0 Product Jumbo Patch MP7 for GA VERSION=6.0,R. Date this patch was last updated by Sun : Sep/29/08 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...