CVE-2006-1298: Format string vulnerability in the Job Engine service (bengine.exe) in the Media Server in Veritas Backup E...

Security readout for executives and security teams

This issue affects old Veritas Backup Exec media servers. If Full Detailed job logging is enabled, a remote authenticated user could use a specially crafted filename on a backed-up machine to crash the Job Engine and possibly run code. Backup systems are high-value, but the source bundle does not show active exploitation. Exposure is likely limited to legacy Windows Backup Exec media servers still running the named revisions with Full Detailed job logs enabled. Risk increases where authenticated users can place filenames on systems included in backup jobs. Treat this as a high-priority legacy backup-system exposure if affected versions remain in use. Backup infrastructure often has broad access, and even a denial of service can disrupt recovery operations. If these versions are absent, no action is needed beyond documentation. Mitigation focus: Inventory Backup Exec media servers and compare versions against the affected revisions.; Consult Symantec SYM06-005 and Veritas document 282254 for vendor-supported fixes or workarounds.; Disable or reduce Full Detailed job logging if vendor guidance supports that change..

Prepared

Jun 29, 2026, 13:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.