PT-2021-11947 · Veritas · Veritas Backup Exec

Published 2021-01-06 · Updated 2021-01-14 · CVE-2020-36167

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AC:L/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions: Veritas Backup Exec versions prior to 16.2 Veritas Backup Exec version 20.6 before hotfix 298543 Veritas Backup Exec version 21.1 before hotfix 657517

Description: An issue in the server allows a low-privileged user to create a malicious configuration file that can load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker to access all data and installed applications. If the system is an Active Directory domain controller, this can affect the entire domain.

Recommendations: For Veritas Backup Exec versions prior to 16.2, update to a version that includes the necessary security fixes. For Veritas Backup Exec version 20.6, apply hotfix 298543 to resolve the issue. For Veritas Backup Exec version 21.1, apply hotfix 657517 to resolve the issue. As a temporary workaround, consider restricting access to the /usr/local/ssl/openssl.cnf configuration file to prevent a low-privileged user from creating a malicious file.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-36167

Affected Products

Veritas Backup Exec

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-36167 · Security Note
• https://veritas.com/content/support/en_US/security/VTS20-010 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36167 · Vendor Advisory
• https://kb.cert.org/vuls/id/429301 · Note