PT-2024-3953 · Veritas · Veritas System Recovery

Published 2024-05-12 · Updated 2024-09-26 · CVE-2024-35204

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Veritas System Recovery versions prior to 23.3 Hotfix

Description The issue is related to incorrect permissions for the Veritas System Recovery folder, allowing low-privileged users to conduct attacks. Exploitation of this issue may enable an attacker to elevate their privileges by creating a specially crafted file in an arbitrary location on the file system.

Recommendations For versions prior to 23.3 Hotfix, update to version 23.3 Hotfix or later to resolve the issue. As a temporary workaround, consider restricting access to the Veritas System Recovery folder to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-275

CWE-272

Related Identifiers

BDU:2024-04367

CVE-2024-35204

Affected Products

Veritas System Recovery

References · 9

• https://bdu.fstec.ru/vul/2024-04367 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35204 · Security Note
• https://vuldb.com/ru/?id.263931 · Note
• https://t.me/cvenotify/80788 · Telegram Post
• https://t.me/cvenotify/96164 · Telegram Post
• https://t.me/cvenotify/80091 · Telegram Post
• https://veritas.com/support/en_US/security/VTS24-005 · Note
• https://twitter.com/CVEnew/status/1789822367470158275 · Twitter Post
• https://t.me/pentestingnews/47629 · Telegram Post