PT-2021-11948 · Veritas · Veritas Resiliency Platform

Published 2021-01-06 · Updated 2021-01-11 · CVE-2020-36168

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AC:L/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions: Veritas Resiliency Platform versions 3.4 through 3.5

Description: An issue in the Veritas Resiliency Platform, which uses OpenSSL on Windows systems with the Managed Host addon, allows for arbitrary code execution as SYSTEM when the service starts. This occurs because the OpenSSL library attempts to load the openssl.cnf configuration file, which does not exist by default. A low-privileged user can create a malicious openssl.cnf configuration file to load a malicious OpenSSL engine. This gives the attacker administrator access on the system, allowing access to all data and installed applications.

Recommendations: For Veritas Resiliency Platform versions 3.4 and 3.5, consider restricting access to the C:usrlocalssl directory to prevent low-privileged users from creating a malicious openssl.cnf configuration file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-36168

Affected Products

Veritas Resiliency Platform

References · 3

• https://veritas.com/content/support/en_US/security/VTS20-015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36168 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36168 · Vendor Advisory