Vulnerabilities > CVE-2007-6016 - Buffer Errors vulnerability in Symantec Backup Exec for Windows Server 11D/12.0

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
symantec
CWE-119
critical
nessus
exploit available
metasploit

Summary

Multiple stack-based buffer overflows in the PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the scheduler component in the Media Server in Symantec Backup Exec for Windows Server (BEWS) 11d 11.0.6235 and 11.0.7170, and 12.0 12.0.1364, allow remote attackers to execute arbitrary code via a long (1) _DOWText0, (2) _DOWText1, (3) _DOWText2, (4) _DOWText3, (5) _DOWText4, (6) _DOWText5, (7) _DOWText6, (8) _MonthText0, (9) _MonthText1, (10) _MonthText2, (11) _MonthText3, (12) _MonthText4, (13) _MonthText5, (14) _MonthText6, (15) _MonthText7, (16) _MonthText8, (17) _MonthText9, (18) _MonthText10, or (19) _MonthText11 property value when executing the Save method. NOTE: the vendor states "Authenticated user involvement required," but authentication is not needed to attack a client machine that loads this control.

Vulnerable Configurations

Part Description Count
Application
Symantec
3

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Exploit-Db

  • descriptionSymantec BackupExec Calendar Control Buffer Overflow. CVE-2007-6016. Remote exploit for windows platform
    idEDB-ID:16582
    last seen2016-02-02
    modified2010-05-09
    published2010-05-09
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/16582/
    titleSymantec BackupExec Calendar Control Buffer Overflow
  • idEDB-ID:5205

Metasploit

descriptionThis module exploits a stack buffer overflow in Symantec BackupExec Calendar Control. By sending an overly long string to the "_DOWText0" property located in the pvcalendar.ocx control, an attacker may be able to execute arbitrary code.
idMSF:EXPLOIT/WINDOWS/BROWSER/SYMANTEC_BACKUPEXEC_PVCALENDAR
last seen2020-03-15
modified2017-10-05
published2008-03-01
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/symantec_backupexec_pvcalendar.rb
titleSymantec BackupExec Calendar Control Buffer Overflow

Nessus

NASL familyWindows
NASL idBEWS_PVCALENDAR_ACTIVEX_MULT_VULNS.NASL
descriptionThe remote host contains the PVATLCalendar.PVCalendar.1 ActiveX control distributed with Symantec Backup Exec for Windows Servers. The installed version of that control reportedly contains two stack-based buffer overflows and allows for corrupting or saving malicious script code, and overwriting arbitrary files. These issues can be triggered by specially crafted arguments to the
last seen2020-06-01
modified2020-06-02
plugin id31351
published2008-03-05
reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/31351
titleSymantec Backup Exec Calendar ActiveX Control Multiple Vulnerabilities (SYM08-007)
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(31351);
  script_version("1.20");
  script_cvs_date("Date: 2018/11/15 20:50:26");

  script_cve_id("CVE-2007-6016", "CVE-2007-6017");
  script_bugtraq_id(26904, 28008);
  script_xref(name:"EDB-ID", value:"5205");
  script_xref(name:"Secunia", value:"27885");

  script_name(english:"Symantec Backup Exec Calendar ActiveX Control Multiple Vulnerabilities (SYM08-007)");
  script_summary(english:"Checks version of Calendar ActiveX control");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host has an ActiveX control that is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote host contains the PVATLCalendar.PVCalendar.1 ActiveX
control distributed with Symantec Backup Exec for Windows Servers.

The installed version of that control reportedly contains two
stack-based buffer overflows and allows for corrupting or saving
malicious script code, and overwriting arbitrary files. These issues
can be triggered by specially crafted arguments to the '_DOWText0'...
'_DOWText6' and '_MonthText0' ... '_MonthText11' properties and then
calling the 'Save()' method.");
  script_set_attribute(attribute:"see_also", value:"https://secuniaresearch.flexerasoftware.com/secunia_research/2007-101/advisory/");
  script_set_attribute(attribute:"see_also", value:"http://www.symantec.com/avcenter/security/Content/2008.02.29.html");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate hotfix as discussed in the vendor advisory
above.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Symantec BackupExec Calendar Control Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_cwe_id(20, 119);

  script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:symantec:veritas_backup_exec");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl");
  script_require_keys("SMB/Registry/Enumerated");
  script_require_ports(139, 445);

  exit(0);
}


include("global_settings.inc");
include("smb_func.inc");
include("smb_activex_func.inc");
include("audit.inc");


if (!get_kb_item("SMB/Registry/Enumerated")) exit(0);


# Check if the control looks like it's vulnerable.
if (activex_init() != ACX_OK) exit(0);

report = NULL;
clsid = "{22ACD16F-99EB-11D2-9BB3-00400561D975}";
file = activex_get_filename(clsid:clsid);
if (file)
{
  # Check its version.
  ver = activex_get_fileversion(clsid:clsid);
  if (ver && activex_check_fileversion(clsid:clsid, fix:"10.0.0.50") == TRUE)
  {
    if (report_paranoia > 1)
      report = string(
        "\n",
        "Version ", ver, " of the vulnerable control is installed as :\n",
        "\n",
        "  ", file, "\n",
        "\n",
        "Note, though, that Nessus did not check whether the kill bit was\n",
        "set for the control's CLSID because of the Report Paranoia setting\n",
        "in effect when this scan was run.\n"
      );
    else if (activex_get_killbit(clsid:clsid) == 0)
      report = string(
        "\n",
        "Version ", ver, " of the vulnerable control is installed as :\n",
        "\n",
        "  ", file, "\n",
        "\n",
        "Moreover, its kill bit is not set so it is accessible via Internet\n",
        "Explorer.\n"
      );
  }
}
activex_end();
if (isnull(report)) exit(0);



# NB: Symantec backported the patch with NetBackup so make sure we're looking at Backup Exec.
# Connect to the appropriate share.
port    =  kb_smb_transport();
login   =  kb_smb_login();
pass    =  kb_smb_password();
domain  =  kb_smb_domain();

if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');
rc = NetUseAdd(login:login, password:pass, domain:domain, share:"IPC$");
if (rc != 1) {
  NetUseDel();
  exit(0);
}


# Connect to remote registry.
hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
if (isnull(hklm))
{
  NetUseDel();
  exit(0);
}


# Determine where Backup Exec is installed.
path = NULL;

key = "SOFTWARE\Symantec\Backup Exec for Windows\Backup Exec";
key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
if (!isnull(key_h))
{
  info = RegQueryInfoKey(handle:key_h);
  for (i=0; i<info[1]; ++i)
  {
    subkey = RegEnumKey(handle:key_h, index:i);
    if (strlen(subkey) && subkey =~ "^[0-9.]+$")
    {
      key2 = key + "\" + subkey + "\Install";
      key2_h = RegOpenKey(handle:hklm, key:key2, mode:MAXIMUM_ALLOWED);
      if (!isnull(key2_h))
      {
        value = RegQueryValue(handle:key2_h, item:"Path");
        if (!isnull(value)) path = value[1];

        RegCloseKey(handle:key2_h);
      }
    }
  }
  RegCloseKey(handle:key_h);
}
RegCloseKey(handle:hklm);
NetUseDel();


# If it is installed, issue the report.
if (path)
{
  if (report_verbosity) security_hole(port:port, extra:report);
  else security_hole(port);
}

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/83131/symantec_backupexec_pvcalendar.rb.txt
idPACKETSTORM:83131
last seen2016-12-05
published2009-11-26
reporterElazar Broad
sourcehttps://packetstormsecurity.com/files/83131/Symantec-BackupExec-Calendar-Control-Buffer-Overflow.html
titleSymantec BackupExec Calendar Control Buffer Overflow

Saint

bid26904
descriptionSymantec Backup Exec for Windows Servers scheduler ActiveX buffer overflow
idmisc_backupexeccalendarax
osvdb42358
titlebackup_exec_ws_scheduler_activex
typeclient

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 28008,26904 CVE(CAN) ID: CVE-2007-6016,CVE-2007-6017 Symantec Backup Exec是一款全面的数据备份解决方案。 Symantec Backup Exec for Windows Server(BEWS)的调度程序组件所安装的ActiveX控件中存在多个栈溢出和不安全函数调用漏洞,远程攻击者可能利用此漏洞控制用户系统。 尽管这个控件不会通过外部Web浏览器调用,但没有正确地解析或验证外部输入,这可能导致浏览器崩溃或允许非授权方式调用,访问或覆盖被破坏的文件。非授权访问有漏洞的控件还可能触发缓冲区溢出,导致在目标用户浏览器的环境中执行任意指令。如果要利用这个漏洞,攻击者必须知道有漏洞控件的具体漏洞,并能够通过HTML邮件或访问恶意网站来诱骗用户上传并执行恶意脚本。 Symantec Backup Exec for Windows Servers 12.0 Symantec Backup Exec for Windows Servers 11d Symantec -------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=http://www.symantec.com/avcenter/security/Content/2008.02.29.html target=_blank>http://www.symantec.com/avcenter/security/Content/2008.02.29.html</a>
idSSV:2976
last seen2017-11-19
modified2008-03-02
published2008-03-02
reporterRoot
titleSymantec Backup Exec调度程序ActiveX栈溢出及文件覆盖漏洞