CVSS: 6.8EPSS: 14%CPEs: 8EXPL: 0CVE-2015-5689 – Symantec Ghost Out-Of-Bounds Indexing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-5689
ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite (GSS) before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution (DS) before 7.6 HF4 12.0.0.7045 performs improper sign-extend operations before array-element accesses, which allows remote attackers to execute arbitrary code, cause a denial of service (application crash), or possibly obtain sensitive information via a crafted Ghost image. Vulnerabilidad en ghostexp.exe en Ghost Explorer Utility en Symantec Ghost Solutions Suite (GSS) en versiones anteriores a 3.0 HF2 12.0.0.8010 y Symantec Deployment Solution (DS) en versiones anteriores a 7.6 HF4 12.0.0.7045, realiza una operación de extensión de signo indebida antes de los accesos a los elementos del array, lo que permite a atacantes remotos ejecutar código arbitrario, causar una denegación de servicio (caída de la aplicación) o posiblemente obtener información sensible a través de una imagen Ghost manipulada. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Ghost. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Ghost images. The issue lies in sign-extending byte values from an array before using them as an index into an array, allowing for out-of-bounds access. • http://www.securityfocus.com/bid/76498 http://www.securitytracker.com/id/1033577 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150902_00 http://zerodayinitiative.com/advisories/ZDI-15-419 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 2%CPEs: 2EXPL: 0CVE-2007-3132
https://notcve.org/view.php?id=CVE-2007-3132
Multiple vulnerabilities in Symantec Ghost Solution Suite 2.0.0 and earlier, with Ghost 8.0.992 and possibly other versions, allow remote attackers to cause a denial of service (client or server crash) via malformed requests to the daemon port, 1346/udp or 1347/udp. Múltiples vulnerabilidades en Symantec Ghost Solution Suite 2.0.0 y versiones anteriores, con Ghost 8.0.992 y posiblemente otra versiones, permiten a atacantes remotos provocar una denegación de servicio (caída de cliente o servidor) mediante peticiones malformadas al puerto del demonio, 1346/udp ó 1347/udp. • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=540 http://osvdb.org/36106 http://secunia.com/advisories/25539 http://securityreason.com/securityalert/2805 http://www.securityfocus.com/archive/1/470644/100/0/threaded http://www.securityfocus.com/bid/24323 http://www.securitytracker.com/id?1018200 http://www.symantec.com/avcenter/security/Content/2007.06.05b.html http://www.vupen.com/english/advisories/2007/2075 https://exchange.xforce.ibmcloud.com/vulnerabilities/ •
CVSS: 3.2EPSS: 0%CPEs: 3EXPL: 0CVE-2006-1285
https://notcve.org/view.php?id=CVE-2006-1285
SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, gives read and write permissions to all users for database shared memory sections, which allows local users to access and possibly modify certain information. • http://secunia.com/advisories/19171 http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html http://securitytracker.com/id?1015733 http://www.securityfocus.com/bid/17019 http://www.vupen.com/english/advisories/2006/0870 •
CVSS: 4.6EPSS: 0%CPEs: 3EXPL: 0CVE-2006-1284
https://notcve.org/view.php?id=CVE-2006-1284
The installation of SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, includes a default administrator login account and password, which allows local users to gain privileges or modify tasks. • http://secunia.com/advisories/19171 http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html http://securitytracker.com/id?1015733 http://www.securityfocus.com/bid/17018 http://www.vupen.com/english/advisories/2006/0870 •
CVSS: 2.1EPSS: 0%CPEs: 3EXPL: 0CVE-2006-1286
https://notcve.org/view.php?id=CVE-2006-1286
Buffer overflow in the login dialog in dbisqlc.exe in SQLAnywhere for Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, might allow local users to read certain sensitive information from the database. • http://secunia.com/advisories/19171 http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html http://securitytracker.com/id?1015733 http://www.vupen.com/english/advisories/2006/0870 https://exchange.xforce.ibmcloud.com/vulnerabilities/25089 •