CVE-2007-2361

3 documents3 sources

Severity

4.9MEDIUM

EPSS

0.1%

top 77.79%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Symantec Backupexec System Recovery Symantec Livestate Recovery Symantec Norton Ghost +1 more

Timeline

PublishedApr 30

Latest updateMay 1

Description

Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore points images are configured, uses weak permissions (world readable) for a configuration file with network share credentials, which allows local users to obtain the credentials by reading the file.

CVSS vector

AV:L/AC:L/C:C/I:N/A:NExploitability: 3.9 | Impact: 6.9

Affected Packages4 packages

▶NVDsymantec/norton_save_and_recovery5 versions+4

▶NVDsymantec/backupexec_system_recovery4 versions+3

▶NVDsymantec/livestate_recovery6.0, 6.01, 6.02+2

▶NVDsymantec/norton_ghost10.0, 10.01+1

Patches

Patch: www.symantec.com ↗Patch: www.symantec.com ↗

🔴Vulnerability Details

GHSA

GHSA-mxhv-qqm4-rmgv: Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore poin↗2022-05-01

▶

CVEList

CVE-2007-2361: Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore poin↗2007-04-30

▶