CERT-In Advisory
CIAD-2005-0014
Multiple Vulnerabilities in VERITAS Backup Exec.
Original Issue Date: July 29, 2005
Severity Rating: High
Systems Affected
- VERITAS NetBackup BusinesServer 4.x
- VERITAS NetBackup DataCenter 4.x
- VERITAS NetBackup Enterprise Server 5.x
- VERITAS NetBackup Server 5.x
- VERITAS Backup Exec 10.x
- VERITAS Backup Exec 9.x
Overview
Multiple vulnerabilities have been reported in VERITAS Backup products, which can be exploited by malicious people to cause a DoS Denial of Service condition, modify OS configuration and execute arbitrary code.
Description
1. Veritas Backup Exec Server Remote Registry Access Vulnerability
(
CAN-2005-0771
)
An access validation vulnerability exists in Veritas Backup Exec for Windows due to some problem exists in RPC handlers port 6106 defined in beserver.exe. This may cause a remote user to gain access with administrative priviledge.
2. Veritas Backup Exec Remote Agent NDMLSRVR.DLL DoS Vulnerability
(
CAN-2005-0772
)
A DoS vulnerability exists within NDMLSRVR.DLL due to a null pointer dereference. Exploitation of this vulnerability may crash the program and cause a denial of service condition.
3. Veritas Backup Exec Agent Error Status Remote DoS Vulnerability
(
CAN-2005-0772
)
This vulnerability exists because of improper handling of request packets with an unexpected "Error Status" value. Successful exploitation of this vulnerability may crash the program and cause denial of service condition.
4. Veritas Backup Exec Agent CONNECT_CLIENT_AUTH Buffer Overflow Vulnerability
(
CAN-2005-0773
)
The vulnerability exists due to insufficient input validation on CONNECT_CLIENT_AUTH requests. Successful exploitation of this vulnerability allows malicious users to execute arbitrary code on the remote system.
Solution
NetBackup 4.5 Maintenance Pack track:
http://support.veritas.com/docs/277495
NetBackup 4.5 Feature Pack track:
http://support.veritas.com/docs/277496
NetBackup Enterprise Server / NetBackup Server 5.0:
http://support.veritas.com/docs/277497
NetBackup Enterprise Server / NetBackup Server 5.1:
http://support.veritas.com/docs/277498
Workaround
Use firewall to restrict incoming connections for port 10000/TCP and 6106/tcp to trusted workstations running the Backup Exec client software.
Vendor Information
VERITAS :
http://seer.support.veritas.com/docs/277485.htm
http://seer.support.veritas.com/docs/276533.htm
http://seer.support.veritas.com/docs/276604.htm
http://seer.support.veritas.com/docs/276605.htm
References
iDEFENSE Security Advisory
http://www.idefense.com/application/poi/display?id=269&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=270&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=271&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=272&type=vulnerabilities
US-CERT Vulnerability Note
http://www.kb.cert.org/vuls/id/492105
http://www.kb.cert.org/vuls/id/352625
http://www.kb.cert.org/vuls/id/584505
Secunia Security Advisory
http://secunia.com/advisories/15789/
http://secunia.com/advisories/15798/
Security Tracker Alert
http://securitytracker.com/alerts/2005/Jun/1014273.html
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|