VERITAS Backup Exec Remote Agent fails to properly validate authentication requests

Overview

Backup Exec Remote Agent for Windows Servers contains a buffer overflow vulnerability due to incorrect validation on authentication requests.

Description

VERITAS Backup Exec is a data backup and recovery solution with support for over the network backup. The VERITAS Backup Exec Agent runs on systems to be backed up listening on TCP port 10000 and is responsible for accepting connections from the backup server when a backup is to occur.

The Backup Exec Remote Agent for Windows Servers contains a buffer overflow vulnerability due to incorrect validation on authentication requests, allowing a remote attacker to execute arbitrary code.

For more details on the vulnerability, see the iDefense security advisory:

http://www.idefense.com/application/poi/display?id=272&type=vulnerabilities.

For information about affected software versions and patching please the VERITAS Software Security Advisory.

VERITAS Software has released information about this and five other security issues affecting VERITAS Backup Exec for Windows and Netware Servers. For more information about this specific vulnerability please see:

VERITAS Software Security Advisory VX05-002 available from <http://seer.support.veritas.com/docs/276604.htm&gt;.

Information on the other vulnerabilities along with patch details can be found at:

<http://seer.support.veritas.com/docs/277428.htm&gt;.

NOTE: We are aware of publicly available exploit code circulating in the wild and have received credible reports of compromise. Additionally, we can confirm significant increases in the levels of network activity directed at TCP port 10000 from the evening of June 25, 2005.

---

Impact

A remote attacker can execute arbitrary code on computers where the Remote Agent is installed and gain administrative control. As the Backup Exec Remote Agent may be running on workstations as well as servers, this vulnerability may provide greater opportunity for attack than the other vulnerabilities identified above.

---

Solution

Apply a patch from the vendor. See <http://seer.support.veritas.com/docs/276604.htm&gt; for details.

---

Workaround

Use firewalls to limit connectivity so that only the backup server(s) can connect to the systems being backed up. The standard port for this service is port 10000.

At minimum, some basic protection should be in effect at the network boundaries. Individual installations may operate on nonstandard ports, which should be taken into account when developing network traffic filtering rules.

Note: even if patching can be done quickly, the above workaround measures should be considered as part of a defense-in-depth strategy for protecting your systems.

---

Vendor Information

492105

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Veritas SOFTWARE __ Affected

Updated: June 24, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

VERITAS Software released information about this vulnerability. See their security bulletin for details:

<http://seer.support.veritas.com/docs/276604.htm&gt;

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23492105 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.us-cert.gov/cas/techalerts/TA05-180A.html&gt;
• <http://seer.support.veritas.com/docs/276604.htm&gt;
• http://www.idefense.com/application/poi/display?id=272&type=vulnerabilities
• <http://seer.support.veritas.com/docs/277428.htm&gt;
• <http://securitytracker.com/alerts/2005/Jun/1014273.html&gt;

Acknowledgements

VERITAS Software in its advisory states:“VERITAS Software appreciates the cooperation of Pedram Amini, iDEFENSE Labs in identifying this issue and coordinating with VERITAS Software in the resolution process.”

This document was written by Robert Mead based on information in the VERITAS Software and iDefense advisories.

Other Information

CVE IDs:	CVE-2005-0773
Severity Metric:	39.91 Date Public: