Symantec patches holes in Veritas Storage Foundation

Symantec has published updates to its Veritas Storage Foundation storage service to close two security holes. Malformed packets arriving at TCP port 4888 cause a memory error in the Veritas Scheduler service (VxSchedService.exe), crashing the service. Prior authentication is not required. The bug is only likely to be exploitable on the local network. Veritas Storage Foundation for Windows 5.0 for Windows 2000 and Windows Server 2003 are affected.

Advertisement

The Administrator service monitoring port 3207 (vxsvc.exe) also has a hole through which code can be fed into a system and executed with system rights or root rights. The cause is a heap overflow triggered by manipulated packets. Veritas Storage Foundation for Windows 5.0 for Windows 2000 and Windows Server 2003 are affected, as well as Veritas Storage Foundation for Unix 5.0 for Solaris, HP-UX, Linux and AIX.

See also:

• Veritas Storage Foundation for Windows by Symantec: Denial of Service in Scheduler Service, vulnerability report by Symantec
• Veritas Storage Foundation by Symantec: Veritas Enterprise Administrator, Heap Overflow, vulnerability report by Symantec
• Symantec VERITAS Storage Foundation Administrator Service Heap Overflow Vulnerability, Fehlerbericht von ZDI
• Symantec Veritas Storage Foundation Scheduler Service DoS Vulnerability, Fehlerbericht von ZDI

(mba)