CVE-2008-0457: Input Validation
First published: Thu Feb 07 2008(Updated: )
Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Symantec Backup Exec System Recovery | =7.0 | |
| Symantec Backup Exec System Recovery | =7.01 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://seer.entsupport.symantec.com/docs/297171.htm
- http://www.symantec.com/avcenter/security/Content/2008.02.04.html
- http://www.securityfocus.com/bid/27487
- http://secunia.com/advisories/28787
- http://www.zerodayinitiative.com/advisories/ZDI-08-003.html
- http://www.securitytracker.com/id?1019303
- http://www.vupen.com/english/advisories/2008/0413
- https://www.exploit-db.com/exploits/5078
- http://www.securityfocus.com/archive/1/487688/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2008-0457?
CVE-2008-0457 has a critical severity due to the potential for remote code execution through arbitrary file uploads.
How do I fix CVE-2008-0457?
To fix CVE-2008-0457, it is recommended to update to the latest version of Symantec Backup Exec System Recovery that addresses this vulnerability.
Who is affected by CVE-2008-0457?
CVE-2008-0457 affects users of Symantec Backup Exec System Recovery versions 7.0 and 7.0.1.
What are the potential impacts of CVE-2008-0457?
The potential impacts of CVE-2008-0457 include unauthorized remote access and execution of malicious code on the server.
Are there any mitigations for CVE-2008-0457?
Yes, implementing strict file upload validations and using firewalls to restrict access to vulnerable services can mitigate the risks associated with CVE-2008-0457.
- agent/remedy
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/references
- agent/last-modified-date
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- agent/softwarecombine
- vendor/symantec
- canonical/symantec backup exec system recovery
- version/symantec backup exec system recovery/7.0
- version/symantec backup exec system recovery/7.01