Vulnerability Note VU#378957

VERITAS Backup Exec Remote Agent is a data backup and recovery solution with support for over-the-network backup. The standard port for the Remote Agent is 10000/tcp. The VERITAS Backup Exec Remote Agent uses a hard-coded, encrypted root password. An attacker with knowledge of this password and access to the Remote Agent may be able to retrieve arbitrary files from a vulnerable system. For more information, please refer to SYM05-011.

Note according to public reports, this vulnerability is actively being exploited.

A remote attacker may be able to gain access to, and retrieve arbitrary files from a target system.

Apply a security update
Install the security updates, as recommended by the Symantec Security Response SYM05-011.

In addition, the following workarounds may mitigate this vulnerability.

Restrict access

You may wish to block access to the vulnerable software from outside your network perimeter, specifically by blocking access to the ports used by VERITAS Backup Exec Remote Agent (typically 10000/tcp). This will limit your exposure to attacks. However, blocking at the network perimeter would still allow attackers within the perimeter of your network to exploit the vulnerability. The use of host-based firewalls in addition to network-based firewalls can help restrict access to specific hosts within the network. It is important to understand your network's configuration and service requirements before deciding what changes are appropriate.

Change the default port for the backup service

Changing the backup service's default port from 10000/tcp may reduce the chances of exploitation. Instructions on how to change the default port for the backup service are available in VERITAS support document 255174.

Encrypt sensitive information

To prevent attackers from reading sensitive information, consider encrypting it on your file system.