How to Register a Service Provider’s Veeam Data Cloud Vault on a Tenant's VBR Server

Purpose This article documents how to add a Veeam Cloud Service Provider's Veeam Data Cloud VDC Vault to their tenant's Veeam Backup Server when that tenant's Veeam Backup Server uses the tenant's own, non-rental, license key. Note: If the customer's Veeam Backup Server is using a rental license...

Veeam Backup Enterprise Manager Vulnerability (CVE-2024-40715)

Issue Details CVE-2024-40715 This vulnerability in Veeam Backup Enterprise Manager allows attackers to bypass the authentication while performing a Man-in-the-Middle MITM attack. Severity: High CVSS v3.1 Score: 7.7AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L This vulnerability was reported by ZDI through...

Linux Hardened Repository Unable to Update Immutability or Remove Restore Points due to SGID

Challenge A job targetting a Hardened Linux Repository Immutable fails with an error about being unable to remove restore points or update immutability examples below. Failed to delete file '/path/to/storage.vbk': Operation not permitted Failed to perform setting immutability for backup Error:...

Veeam Backup and Replication Credentials Dump

This module exports and decrypts credentials from Veeam Backup & Replication and Veeam ONE Monitor Server to a CSV file; it is intended as a post-exploitation module for Windows hosts with either of these products installed. The module supports automatic detection of VBR / Veeam ONE and is capabl...

VSPC 5 fails to collect Monthly License Usage Report from VBR v11a

Challenge Monthly License Usage Report cannot be collected from Veeam Backup & Replication servers running version 11a. Cause The license usage data generated by Veeam Backup & Replication 11a is incompatible with Veeam Service Provider Console VSPC versions prior to v5 Patch 4. Solution This iss...

Chinese Researchers Disrupt Malware Attack That Infected Thousands of PCs

Chinese security firm Qihoo 360 Netlab said it partnered with tech giant Baidu to disrupt a malware botnet infecting over hundreds of thousands of systems. The botnet was traced back to a group it calls ShuangQiang also called Double Gun, which has been behind several attacks since 2017 aimed at...

UBUNTU-CVE-2015-8026

Heap-based buffer overflow in the verifyvbrchecksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service infinite loop or possibly execute arbitrary code via a crafted filesystem...

DEBIAN-CVE-2015-8026

Heap-based buffer overflow in the verifyvbrchecksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service infinite loop or possibly execute arbitrary code via a crafted filesystem...

PT-2017-7314

Name of the Vulnerable Software and Affected Versions exfat-utils versions prior to 1.2.1 Description The issue is related to a heap-based buffer overflow in the verify vbr checksum function in exfatfsck, which can be exploited by remote attackers using a crafted filesystem. This can lead to a...

Persistent Financial Malware 'Nemesis' Targets Boot Record

A group of attackers are behind a strain of payment card malware that has bootkit functionality, something that makes it very difficult to detect, much less remove. “FIN1,” the group behind the malware, appears to be based in Russia, according to researchers at both FireEye and Mandiant who...

Thriving Beyond The Operating System: Financial Threat Group Targets Volume Boot Record

In September, Mandiant Consulting identified a financially motivated threat group targeting payment card data using sophisticated malware that executes before the operating system boots. This rarely seen technique, referred to as a ‘bootkit’, infects lower-level system components making it very...

Veeam Backup & Replication Upgrade Paths

Purpose This article documents upgrade paths available to Windows-based Veeam Backup & Replication deployments to reach the latest version. Solution VSA Migration Version Limitation Migration from Windows-based Veeam Backup & Replication to Veeam Software Appliance is not supported on version 13....