{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Symantec Backup Exec for Windows Server version 11d build 6235.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Symantec",
          "scada": false
        }
      }
    },
    {
      "description": "Symantec Backup Exec for Windows Server version 11d build 7170 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Symantec",
          "scada": false
        }
      }
    },
    {
      "description": "Symantec Backup Exec for Windows Server version 12 build 1364 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Symantec",
          "scada": false
        }
      }
    },
    {
      "description": "Symantec Backup Exec for Windows Server version 12.5 build 2213 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Symantec",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s permettent de contourner le m\u00e9canisme\nd\u0027authentification des agents Symantec Backup Exec. Une personne\nmalintentionn\u00e9e peut ainsi r\u00e9cup\u00e9rer ou effacer des fichiers sur la\nmachine attaqu\u00e9e.\n\nUne vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire dans le protocole de\ngestion des donn\u00e9es permet \u00e0 un utilisateur authentifi\u00e9 d\u0027ex\u00e9cuter du\ncode arbitraire.\n\nLa combinaison de ces vuln\u00e9rabilit\u00e9s permet \u00e0 une personne malveillante\nd\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2008-11-20T00:00:00",
  "last_revision_date": "2008-11-20T00:00:00",
  "links": [],
  "reference": "CERTA-2008-AVI-559",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-11-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s dans \u003cspan class=\"textit\"\u003eSymantec Backup\nExec for Windows Server\u003c/span\u003e permettent de contourner le m\u00e9canisme\nd\u0027authentification et d\u0027ex\u00e9cuter du code arbitraire.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Symantec Backup Exec",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Symantec SYM08-021 du 19 novembre 2008",
      "url": "http://securityresponse.symantec.com/avcenter/security/Content/2008.11.19.html"
    }
  ]
}