9.3

CVE-2008-0638

Heap-based buffer overflow in the Veritas Enterprise Administrator (VEA) service (aka vxsvc.exe) in Symantec Veritas Storage Foundation 5.0 allows remote attackers to execute arbitrary code via a packet with a crafted value of a certain size field, which is not checked for consistency with the actual buffer size.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Symantec ≫ Veritas Storage Foundation Version 5.0 Edition aix
Symantec ≫ Veritas Storage Foundation Version 5.0 Edition hp_ux
Symantec ≫ Veritas Storage Foundation Version 5.0 Edition linux
Symantec ≫ Veritas Storage Foundation Version 5.0 Edition solaris
Symantec ≫ Veritas Storage Foundation Version 5.0 Edition windows_2000
Symantec ≫ Veritas Storage Foundation Version 5.0 Update 32bit Edition windows_2003
Symantec ≫ Veritas Storage Foundation Version 5.0 Update 64bit Edition windows_2003
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.96% 0.923
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://secunia.com/advisories/29050
http://securitytracker.com/id?1019459
http://www.securityfocus.com/archive/1/488420/100/0/threaded
http://www.securityfocus.com/bid/25778
Patch
http://www.symantec.com/avcenter/security/Content/2008.02.20a.html
Patch
http://www.zerodayinitiative.com/advisories/ZDI-08-007.html