Veeam Agent for Microsoft Windows Vulnerability (CVE-2024-29853)

Veeam Software Security Commitment

Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits. When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information. This approach ensures that all potentially affected customers can quickly implement the necessary measures to safeguard their systems. It's important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software. This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay.

Upgrading Standalone vs Managed Veeam Agent Deployment

Please keep in mind that Veeam Agent for Microsoft Windows (VAW) has two primary operation modes, either standalone or managed. When VAW is managed by Veeam Backup & Replication (VBR) or Veeam Service Provider Console (VSPC), the VAW deployment must be upgraded by the server that manages it. Directly upgrading a VAW deployment that VBR manages will likely result in a compatibility issue if the deployed VAW version is higher than the VBR software expects.

• If VAW is operating in purely Standalone operation mode (not targetting a VBR or Cloud Connect repository), it can be upgraded directly on the machine where it is installed.

• If VAW is operating in Standalone operation mode but targets a VBR or Cloud Connect repository, the destination VBR or Cloud Connect deployment must be upgraded to a version that supports the new VAW version before upgrading VAW directly.

• If a VBR server manages VAW, you must upgrade VBR first, then upgrade the managed VAW deployments.

• If a VSPC server manages VAW, the VAW deployment must be upgraded using the VSPC console.

Issue Details

CVE-2024-29853

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

Severity: High **CVSS v3.1 Score: **7.2AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability testing was only performed against actively supported versions of Veeam Agent for Microsoft Windows.

Solution

The vulnerability documented in this article was fixed starting in the following build:

• Veeam Agent for Microsoft Windows 6.1.2 (build 6.1.2.134)

This build of Veeam Agent for Microsoft Windows was included with Veeam Backup & Replication 12.1.2.172.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.