PT-2021-11946 · Veritas · Infoscale Operations Manager+2

Published 2021-01-06 · Updated 2021-01-12 · CVE-2020-36166

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AC:L/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions: Veritas InfoScale versions 7.x through 7.4.2 Storage Foundation versions through 6.1 Storage Foundation HA versions through 6.1 InfoScale Operations Manager (aka VIOM) Windows Management Server versions 7.x through 7.4.2

Description: An issue allows a low-privileged user to create a malicious configuration file that can load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker to access all data and installed applications.

Recommendations: For Veritas InfoScale versions 7.x through 7.4.2, consider restricting access to the directory where the OpenSSL configuration file is loaded to prevent a low-privileged user from creating a malicious configuration file. For Storage Foundation versions through 6.1, restrict access to the directory where the OpenSSL configuration file is loaded to minimize the risk of exploitation. For Storage Foundation HA versions through 6.1, consider disabling the loading of the OpenSSL library from the usrlocalssl directory until a patch is available. For InfoScale Operations Manager (aka VIOM) Windows Management Server versions 7.x through 7.4.2, avoid using the default Windows installation drive to load the OpenSSL configuration file, and instead use a secure location to load the configuration file.

Fix

Related Identifiers

CVE-2020-36166

Affected Products

Infoscale Operations Manager

Storage Foundation

Veritas Infoscale

References · 3

• https://veritas.com/content/support/en_US/security/VTS20-014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36166 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36166 · Vendor Advisory