CVE-2005-3566

CVE-2005-3566 is a medium-severity vulnerability in Symantec Veritas Cluster Server with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

• Severity: Medium (CVSS 2.0 base score 4.3)
• EPSS exploit prediction: 1% (65th percentile)
• Actively exploited: Not listed in CISA KEV
• Affected product: Symantec Veritas Cluster Server
• Published: 2005-11-16
• Last modified: 2026-06-16

Description

Buffer overflow in various ha commands of VERITAS Cluster Server for UNIX before 4.0MP2 allows local users to execute arbitrary code via a long VCSI18N_LANG environment variable to (1) haagent, (2) haalert, (3) haattr, (4) hacli, (5) hacli_runcmd, (6) haclus, (7) haconf, (8) hadebug, (9) hagrp, (10) hahb, (11) halog, (12) hareg, (13) hares, (14) hastatus, (15) hasys, (16) hatype, (17) hauser, and (18) tststew.

Frequently asked questions

What is CVE-2005-3566?

Buffer overflow in various ha commands of VERITAS Cluster Server for UNIX before 4.0MP2 allows local users to execute arbitrary code via a long VCSI18N_LANG environment variable to (1) haagent, (2) haalert, (3) haattr, (4) hacli, (5) hacli_runcmd, (6) haclus, (7) haconf, (8) hadebug, (9) hagrp, (10) hahb, (11) halog, (12) hareg, (13) hares, (14) hastatus, (15) hasys, (16) hatype, (17) hauser, and (18) tststew.

How severe is CVE-2005-3566?

CVE-2005-3566 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2005-3566 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (65th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2005-3566?

CVE-2005-3566 primarily affects Symantec Veritas Cluster Server. In total, 40 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2005-3566?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2005-3566 published?

CVE-2005-3566 was published on 2005-11-16 and last updated on 2026-06-16.

References

• http://marc.info/?l=bugtraq&m=113199516516880&w=2
• http://osvdb.org/20673
• http://secunia.com/advisories/17502
• http://securityreason.com/securityalert/174
• http://securityresponse.symantec.com/avcenter/security/Content/2005.11.08a.html
• http://securitytracker.com/id?1015169
• http://www.securityfocus.com/bid/15349
• http://www.vupen.com/english/advisories/2005/2350
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22986

Affected products (40)

• cpe:2.3:a:symantec_veritas:cluster_server:2.2:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:2.2_linux:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:2.2_linux_mp1p1:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:2.2_mp1:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:2.2_mp2:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_aix:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_hp-ux:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_hp-ux_update_1:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_hp-ux_update_2:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_mp1:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_mp1j:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_mp2:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_p1:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_solaris:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_solaris_beta:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_solaris_mp1:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_solaris_mp2:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:3.5_solaris_mp3:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:4.0_aix:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:4.0_aix_beta:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:4.0_linux:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:4.0_linux_beta:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:4.0_solaris:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:4.0_solaris_beta:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:cluster_server:4.0_solaris_mp1:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:sanpoint_control_quickstart:3.5_solaris:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation:1.0_aix:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation:2.2_linux:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation:2.2_vmware_esx:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation:3.0_aix:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation:3.4_aix:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation:3.5_hp-ux:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation:3.5_solaris:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation:4.0_aix:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation:4.0_linux:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation:4.0_solaris:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation_cluster_file_system:4.0_aix:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation_cluster_file_system:4.0_linux:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:storage_foundation_cluster_file_system:4.0_solaris:*:*:*:*:*:*:*

More vulnerabilities in Symantec Veritas Cluster Server

• CVE-2002-1817 — High (CVSS 7.5): Unknown vulnerability in Veritas Cluster Server (VCS) 1.2 for WindowsNT, Cluster Server 1.3.0 for Solaris, and Cluster…
• CVE-2004-2205 — High (CVSS 7.2): Unknown vulnerability in Veritas Cluster Server 1.0.1 through 4.0 allows local users to gain root access via…
• CVE-2001-0287 — Low (CVSS 2.1): VERITAS Cluster Server (VCS) 1.3.0 on Solaris allows local users to cause a denial of service (system panic) via the -L…

All CVEs affecting Symantec Veritas Cluster Server →