NVD

Id
3568  
Name
CVE-2008-3703  
Description
The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (SFW) 5.0, 5.0 RP1a, and 5.1 accepts NULL NTLMSSP authentication, which allows remote attackers to execute arbitrary code via requests to the service socket that create "snapshots schedules" registry values specifying future command execution. NOTE: this issue exists because of an incomplete fix for CVE-2007-2279.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2008-08-18  
Modified Date
2011-03-07  
Seq
2008-3703  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
22607 3568 CVE-2008-3703 4161  View
22608 3568 CVE-2008-3703 1020699  View
22609 3568 CVE-2008-3703 http://seer.entsupport.symantec.com/docs/306386.htm  View
22610 3568 CVE-2008-3703 20080814 SYM08-015_SFW_SecurityUpdateBypass  View
22611 3568 CVE-2008-3703 20080814 ZDI-08-053: Symantec Veritas Storage Foundation Scheduler Service NULL Session Authentication Bypass Vulnerability  View
22612 3568 CVE-2008-3703 30596  View
22613 3568 CVE-2008-3703 http://www.symantec.com/avcenter/security/Content/2008.08.14a.html  View
22614 3568 CVE-2008-3703 ADV-2008-2395  View
22615 3568 CVE-2008-3703 http://www.zerodayinitiative.com/advisories/ZDI-08-053/  View
22616 3568 CVE-2008-3703 vsf-vxschedservice-code-execution(44466)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
50838 JVNDB-2008-006148 Windows 用の SFW における任意のコードを実行される脆弱性 Windows 用の Symantec Veritas Storage Foundation (SFW) の Volume Manager Scheduler Service の管理コンソールは、NULL NTLMSSP 認証を受け付けるため、任意のコードを実行される脆弱性が存在します。 CVE-2008-3703 33816 CVE-2008-3703 3568 10 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-006148.html 2008-08-14 2012-12-20 View