PT-2017-2902 · Veritas · Veritas Backup Exec

Publicado 2017-05-10 · Atualizado 2021-08-12 · CVE-2017-8895

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Veritas Backup Exec versions prior to 14.1.1187.1126 Veritas Backup Exec versions prior to 14.2.1180.3160 Veritas Backup Exec 16 before FP1

Description The issue is related to a use-after-free vulnerability in multiple agents of the Veritas Backup Exec software. This vulnerability can be exploited by an unauthenticated attacker to cause a denial of service or potentially achieve remote code execution. The attacker could crash the agent or take control of the agent process and then the system it is running on. The vulnerability can also be exploited using specially crafted NDMP data.

Recommendations For Veritas Backup Exec versions prior to 14.1.1187.1126, update to build 14.1.1187.1126 or later. For Veritas Backup Exec versions prior to 14.2.1180.3160, update to build 14.2.1180.3160 or later. For Veritas Backup Exec 16 before FP1, apply FP1 or later.

Exploit

Correção

RCE

DoS

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

BDU:2017-02225

CVE-2017-8895

Produtos afetados

Veritas Backup Exec

Referências · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/backupexec/ssl_uaf.rb · Exploit
• 🔥 https://exploit-db.com/exploits/42282 · Exploit
• http://securityfocus.com/bid/98386/info · Nota
• https://bdu.fstec.ru/vul/2017-02225 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-8895 · Aviso do Fabricante
• http://securityfocus.com/bid/98386 · Nota
• http://securitytracker.com/id/1038561 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-8895 · Nota de Segurança
• https://veritas.com/content/support/en_US/security/VTS17-006.html#Issue1 · Aviso do Fabricante