CVE-2007-6017

Severity Score

5.1

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the scheduler component in the Media Server in Symantec Backup Exec for Windows Server (BEWS) 11d 11.0.6235 and 11.0.7170, and 12.0 12.0.1364, exposes the unsafe Save method, which allows remote attackers to cause a denial of service (browser crash), or create or overwrite arbitrary files, via string values of the (1) _DOWText0, (2) _DOWText1, (3) _DOWText2, (4) _DOWText3, (5) _DOWText4, (6) _DOWText5, (7) _DOWText6, (8) _MonthText0, (9) _MonthText1, (10) _MonthText2, (11) _MonthText3, (12) _MonthText4, (13) _MonthText5, (14) _MonthText6, (15) _MonthText7, (16) _MonthText8, (17) _MonthText9, (18) _MonthText10, and (19) _MonthText11 properties. NOTE: the vendor states "Authenticated user involvement required," but authentication is not needed to attack a client machine that loads this control.

El Control ActiveX de PVATLCalendar.PVCalendar.1 en el archivo pvcalendar.ocx en el componente scheduler en el servidor multimedia de Symantec Backup Exec para Windows Server (BEWS) 11d versiones 11.0.6235 y 11.0.7170 y 12.0 12.0.1364, expone el método Save no seguro, que permite a atacantes remotos causar una denegación de servicio (bloqueo del navegador), o crear o sobrescribir archivos arbitrarios, por medio de valores de cadena de las propiedades (1) _DOWText0, (2) _DOWText1, (3) _DOWText2, (4) _DOWText3, (5) _DOWText4, (6) _DOWText5, (7) _DOWText6, (8) _MonthText0, (9) _MonthText1, (10) _MonthText2, (11) _MonthText3, (12) _MonthText4, (13) _MonthText5, (14) _MonthText6, (15) _MonthText7, (16) _MonthText8, (17) _MonthText9, (18) _MonthText10, y (19) _MonthText11. NOTA: el proveedor indica "Authenticated user involvement required", pero no es necesaria la autenticación para atacar un equipo cliente que carga este control.

*Credits: N/A

CVSS Scores

NISTv2 5.1

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-11-19 CVE Reserved
2008-02-29 CVE Published
2024-08-07 CVE Updated
2024-10-18 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (11)

URL	Tag	Source
http://securitytracker.com/id?1019525	Vdb Entry
http://seer.entsupport.symantec.com/docs/300471.htm	X_refsource_confirm
http://seer.support.veritas.com/docs/308669.htm	X_refsource_confirm
http://support.veritas.com/docs/300471	X_refsource_confirm
http://www.securityfocus.com/bid/28008	Vdb Entry
http://www.symantec.com/avcenter/security/Content/2008.02.28.html	X_refsource_confirm
http://www.symantec.com/avcenter/security/Content/2008.02.29.html	X_refsource_confirm
http://www.vupen.com/english/advisories/2008/0718	Vdb Entry
http://www.vupen.com/english/advisories/2008/2672	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/27885	2011-03-08
http://secunia.com/secunia_research/2007-101	2011-03-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Symantec Search vendor "Symantec"		Backup Exec For Windows Server Search vendor "Symantec" for product "Backup Exec For Windows Server"				11d Search vendor "Symantec" for product "Backup Exec For Windows Server" and version "11d"		11.0.6235		Affected
Symantec Search vendor "Symantec"		Backup Exec For Windows Server Search vendor "Symantec" for product "Backup Exec For Windows Server"				11d Search vendor "Symantec" for product "Backup Exec For Windows Server" and version "11d"		11.0.7170		Affected
Symantec Search vendor "Symantec"		Backup Exec For Windows Server Search vendor "Symantec" for product "Backup Exec For Windows Server"				12.0 Search vendor "Symantec" for product "Backup Exec For Windows Server" and version "12.0"		12.0.1364		Affected