Symantec Backup Exec for Windows RPC Crafted ncacn_ip_tcp Request Remote Overflow

High Nessus Plugin ID 25707


Arbitrary code can be executed on the remote host.


The remote host is running a version of VERITAS Backup Windows RPC server which is vulnerable to a remote buffer overflow. An attacker may exploit this flaw to execute arbitrary code on the remote host or to disable this service remotely.

To exploit this flaw, an attacker would need to send a specially crafted packet to the remote service.


Plugin Details

Severity: High

ID: 25707

File Name: symantec_backup_exec_rpc_heap_overflows2.nasl

Version: $Revision: 1.12 $

Type: remote

Agent: windows

Family: Windows

Published: 2007/07/16

Modified: 2011/06/11

Dependencies: 10785

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:symantec:veritas_backup_exec

Required KB Items: Host/OS/smb

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2007/07/11

Vulnerability Publication Date: 2007/07/12

Reference Information

CVE: CVE-2007-3509

BID: 23897

OSVDB: 36111