Symantec Security Advisory

SYM06-004

27 March  2006

Veritas NetBackup (tm) for NetWare Media Server Options:  Application Memory Denial of Service

Revision History
3/27/2006 - Updated advisory to include NetBackup for NetWare Media Servers Option versions as affected with solution download locations

Severity
Medium

 

Type of Exploit	Vulnerable
Remote Access	Yes
Local Access	No
Authentication Required	No
Exploit publicly available	No

Overview
During internal reviews of supported Veritas NetBackup for NetWare Media Server Options products and versions, Symantec identified and fixed memory errors that could result in a process crash or a denial of service (DoS) preventing ongoing backup capability until backup services are restarted.

Supported Product(s) and Agent Affected
 

Product	Version	Solution(s)
NetBackup for Netware Media Server Option	4.5MP	NB_NMS_45_9S2_M
NetBackup for Netware Media Server Option	4.5FP	NB_NMS_45_9S2_F
NetBackup for Netware Media Server Option	5.0	NB_NMS_50_6S01_M
NetBackup for Netware Media Server Option	5.1	NB_NMS_51_4S01_M
NetBackup for Netware Media Server Option	6.0	NB_NMS_60_2_M

NOTE:  ONLY the products and versions listed above are known to be affected by these issues.  

Product versions prior to those listed above are NOT supported.  Customers running any of the affected product versions, listed above, should upgrade and apply updates.

Details
Symantec engineers resolved issues discovered during internal review in which malformed input could potentially cause memory access violations or exhaust system resources.  Any of these issues could cause a process crash or DoS and temporary loss of backup capability.  In the majority of issues, the affected service would need to be restarted to regain operational capability.

Symantec Response

Security updates are available for all supported affected products. Symantec recommends all customers apply the latest updates for their supported product versions to protect against these types of threats.

Symantec knows of no adverse customer impact from this issue.

The Maintenance Packs listed above for affected Veritas NetBackup for NetWare Media Server Options are available in the Related Documents section below, or from the Support Web site:

NetBackup Enterprise Server/Server 5.0, 5.1 and 6.0:    http://support.veritas.com/menu_ddProduct_NBUESVR_view_DOWNLOAD.htm

NetBackup DataCenter/BusinesServer 4.5:    http://www.support.veritas.com/menu_ddProduct_NETBACKUPDC_view_DOWNLOAD.htm

Best Practices

CVE
A CVE candidate number will be requested from The Common Vulnerabilities and Exposures (CVE) initiative. This advisory will be revised as required once the CVE candidate number has been assigned. This issue is a candidate for inclusion in the CVE list which standardizes names for security problems.    http://cve.mitre.org/