CVE-2008-3703 — HIGH (10.0)

Vulnerability Description

The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (SFW) 5.0, 5.0 RP1a, and 5.1 accepts NULL NTLMSSP authentication, which allows remote attackers to execute arbitrary code via requests to the service socket that create "snapshots schedules" registry values specifying future command execution. NOTE: this issue exists because of an incomplete fix for CVE-2007-2279.

CVSS Score

10.0

HIGH

AV:N/AC:L/Au:N/C:C/I:C/A:C

Confidentiality

COMPLETE

Integrity

COMPLETE

Availability

COMPLETE

Affected Products

Vendor	Product	Versions
Symantec	Veritas Storage Foundation	5.0

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2008-3703?

CVE-2008-3703 is a vulnerability with a CVSS score of 10.0 (HIGH). The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (SFW) 5.0, 5.0 RP1a, and 5.1 accepts NULL NTLMSSP authenticat...

How severe is CVE-2008-3703?

CVE-2008-3703 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2008-3703?

Check the references section above for vendor advisories and patch information. Affected products include: Symantec Veritas Storage Foundation.