Vulnerability Note VU#378957

VERITAS Backup Exec uses hard-coded authentication credentials

Original Release date: 12 Aug 2005 | Last revised: 12 Jan 2007

Overview

The VERITAS Backup Exec Remote Agent uses hard-coded authentication credentials. An attacker with knowledge of these credentials could access arbitrary files on a vulnerable system.

Description

VERITAS Backup Exec Remote Agent is a data backup and recovery solution with support for over-the-network backup. The standard port for the Remote Agent is 10000/tcp. The VERITAS Backup Exec Remote Agent uses a hard-coded, encrypted root password. An attacker with knowledge of this password and access to the Remote Agent may be able to retrieve arbitrary files from a vulnerable system. For more information, please refer to SYM05-011.

Note according to public reports, this vulnerability is actively being exploited.

Impact

A remote attacker may be able to gain access to, and retrieve arbitrary files from a target system.

Solution

Apply a security update
Install the security updates, as recommended by the Symantec Security Response SYM05-011.

In addition, the following workarounds may mitigate this vulnerability.

Restrict access


You may wish to block access to the vulnerable software from outside your network perimeter, specifically by blocking access to the ports used by VERITAS Backup Exec Remote Agent (typically 10000/tcp). This will limit your exposure to attacks. However, blocking at the network perimeter would still allow attackers within the perimeter of your network to exploit the vulnerability. The use of host-based firewalls in addition to network-based firewalls can help restrict access to specific hosts within the network. It is important to understand your network's configuration and service requirements before deciding what changes are appropriate.

Change the default port for the backup service

Changing the backup service's default port from 10000/tcp may reduce the chances of exploitation. Instructions on how to change the default port for the backup service are available in VERITAS support document 255174.

Encrypt sensitive information

To prevent attackers from reading sensitive information, consider encrypting it on your file system.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Symantec, Inc.Affected12 Aug 200522 Sep 2005
Veritas Backup-ExecAffected-12 Aug 2005
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This vulnerability was reported by Symantec.

This document was written by Jeff Gennari.

Other Information

  • CVE IDs: CVE-2005-2611
  • Date Public: 12 Aug 2005
  • Date First Published: 12 Aug 2005
  • Date Last Updated: 12 Jan 2007
  • Severity Metric: 36.98
  • Document Revision: 107

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.