----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
Symantec Backup Exec Calendar Control Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA27885

VERIFY ADVISORY:
http://secunia.com/advisories/27885/

CRITICAL:
Moderately critical

IMPACT:
Manipulation of data, System access

WHERE:
>From remote

SOFTWARE:
Symantec Backup Exec for Windows Servers 11.x
http://secunia.com/product/14564/
Symantec Backup Exec for Windows Servers 12.x
http://secunia.com/product/17844/

DESCRIPTION:
Secunia Research has discovered some vulnerabilities in Symantec
Backup Exec for Windows Servers, which can be exploited by malicious
people to overwrite arbitrary files or compromise a vulnerable
system.

1) Two boundary errors exist within the PVATLCalendar.PVCalendar.1
(pvcalendar.ocx) ActiveX control when handling strings assigned to
various properties (e.g. "_DOWText0" to "_DOWText6", "_MonthText0" to
"_MonthText11"). This can be exploited to cause stack-based buffer
overflows by assigning overly-long strings to the affected properties
and then calling the "Save()" method .

2) The PVATLCalendar.PVCalendar.1 (pvcalendar.ocx) ActiveX control
includes the insecure "Save()" method, which can be exploited to e.g.
overwrite and corrupt arbitrary files or save malicious script code to
an arbitrary location on the target system by assigning strings to
certain properties (e.g. "_DOWText0" to "_DOWText6", "_MonthText0" to
"_MonthText11").

Successful exploitation of the vulnerabilities allow execution of
arbitrary code.

The vulnerabilities are confirmed in pvcalendar.ocx version 10.0.0.17
included in Symantec Backup Exec for Windows Servers version 11d build
7170, and affects the following versions:
* Symantec Backup Exec for Windows Server 11d build 11.0.6235
* Symantec Backup Exec for Windows Server 11d build 11.0.7170
* Symantec Backup Exec for Windows Server 12.0 build 12.0.1364

SOLUTION:
Apply hotfix.
http://seer.entsupport.symantec.com/docs/300471.htm

PROVIDED AND/OR DISCOVERED BY:
JJ Reyes, Secunia Research

ORIGINAL ADVISORY:
SYM08-007:
http://www.symantec.com/avcenter/security/Content/2008.02.28.html

Secunia Research:
http://secunia.com/secunia_research/2007-101/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------