CVE-2020-36160

An issue was discovered in Veritas System Recovery before 21.2. On start-up, it loads the OpenSSL library from \usr\local\ssl. This library attempts to load the from \usr\local\ssl\openssl.cnf configuration file, which does not exist. By default, on Windows systems, users can create directories...

CVE-2020-36160

Veritas System Recovery (pre-21.2) loads the OpenSSL library from \usr\local\ssl at startup and attempts to read \usr\local\ssl\openssl.cnf, which does not exist. A low-privilege user can create C:\usr\local\ssl\openssl.cnf to load a malicious OpenSSL engine, enabling arbitrary code execution as ...