|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
|
Vulnerability Note VU#378957
VERITAS Backup Exec uses hard-coded authentication credentials
OverviewThe VERITAS Backup Exec Remote Agent uses hard-coded authentication credentials. An attacker with knowledge of these credentials could access arbitrary files on a vulnerable system.
I. DescriptionVERITAS Backup Exec Remote Agent is a data backup and recovery solution with support for over-the-network backup. The standard port for the Remote Agent is 10000/tcp. The VERITAS Backup Exec Remote Agent uses a hard-coded, encrypted root password. An attacker with knowledge of this password and access to the Remote Agent may be able to retrieve arbitrary files from a vulnerable system. For more information, please refer to SYM05-011.
Note according to public reports, this vulnerability is actively being exploited.
II. ImpactA remote attacker may be able to gain access to, and retrieve arbitrary files from a target system.
III. SolutionApply a security update
Install the security updates, as recommended by the Symantec Security Response SYM05-011.
In addition, the following workarounds may mitigate this vulnerability.
Restrict access
You may wish to block access to the vulnerable software from outside your network perimeter, specifically by blocking access to the ports used by VERITAS Backup Exec Remote Agent (typically 10000/tcp). This will limit your exposure to attacks. However, blocking at the network perimeter would still allow attackers within the perimeter of your network to exploit the vulnerability. The use of host-based firewalls in addition to network-based firewalls can help restrict access to specific hosts within the network. It is important to understand your network's configuration and service requirements before deciding what changes are appropriate.
Change the default port for the backup service
Changing the backup service's default port from 10000/tcp may reduce the chances of exploitation. Instructions on how to change the default port for the backup service are available in VERITAS support document 255174.
Encrypt sensitive information
To prevent attackers from reading sensitive information, consider encrypting it on your file system.
Systems Affected
References
http://seer.support.veritas.com/docs/278434.htm
http://support.veritas.com/docs/255831
http://seer.support.veritas.com/docs/255174.htm
http://seer.support.veritas.com/docs/258334.htm
http://securityresponse.symantec.com/avcenter/security/Content/2005.08.12b.html
http://securityresponse.symantec.com
http://secunia.com/advisories/16403/
http://www.frsirt.com/english/advisories/2005/1387
http://isc.sans.org/diary.php?date=2005-08-11
http://www.securitytracker.com/alerts/2005/Aug/1014662.html
http://xforce.iss.net/xforce/xfdb/21793
http://www.ndmp.org/
Credit
This vulnerability was reported by Symantec.
This document was written by Jeff Gennari.
Other Information
| Date Public | 08/12/2005 |
| Date First Published | 08/12/2005 12:34:02 PM |
| Date Last Updated | 01/12/2007 |
| CERT Advisory | |
| CVE-ID(s) | CVE-2005-2611 |
| NVD-ID(s) | CVE-2005-2611 |
| US-CERT Technical Alerts | |
| Metric | 36.98 |
| Document Revision | 107 |
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
|