Vulnerability Note VU#378957

VERITAS Backup Exec uses hard-coded authentication credentials

Overview

The VERITAS Backup Exec Remote Agent uses hard-coded authentication credentials. An attacker with knowledge of these credentials could access arbitrary files on a vulnerable system.

I. Description

VERITAS Backup Exec Remote Agent is a data backup and recovery solution with support for over-the-network backup. The standard port for the Remote Agent is 10000/tcp. The VERITAS Backup Exec Remote Agent uses a hard-coded, encrypted root password. An attacker with knowledge of this password and access to the Remote Agent may be able to retrieve arbitrary files from a vulnerable system. For more information, please refer to SYM05-011.

Note according to public reports, this vulnerability is actively being exploited.

II. Impact

A remote attacker may be able to gain access to, and retrieve arbitrary files from a target system.

III. Solution

Apply a security update

Install the security updates, as recommended by the Symantec Security Response SYM05-011.

In addition, the following workarounds may mitigate this vulnerability.

Restrict access

You may wish to block access to the vulnerable software from outside your network perimeter, specifically by blocking access to the ports used by VERITAS Backup Exec Remote Agent (typically 10000/tcp). This will limit your exposure to attacks. However, blocking at the network perimeter would still allow attackers within the perimeter of your network to exploit the vulnerability. The use of host-based firewalls in addition to network-based firewalls can help restrict access to specific hosts within the network. It is important to understand your network's configuration and service requirements before deciding what changes are appropriate.

Change the default port for the backup service

Changing the backup service's default port from 10000/tcp may reduce the chances of exploitation. Instructions on how to change the default port for the backup service are available in VERITAS support document 255174.

Encrypt sensitive information

To prevent attackers from reading sensitive information, consider encrypting it on your file system.

Systems Affected

Vendor	Status	Date Updated
Symantec, Inc.	Vulnerable	22-Sep-2005
Veritas Backup-Exec	Vulnerable	12-Aug-2005

References

http://seer.support.veritas.com/docs/278434.htm
http://support.veritas.com/docs/255831
http://seer.support.veritas.com/docs/255174.htm
http://seer.support.veritas.com/docs/258334.htm
http://securityresponse.symantec.com/avcenter/security/Content/2005.08.12b.html
http://securityresponse.symantec.com
http://secunia.com/advisories/16403/
http://www.frsirt.com/english/advisories/2005/1387
http://isc.sans.org/diary.php?date=2005-08-11
http://www.securitytracker.com/alerts/2005/Aug/1014662.html
http://xforce.iss.net/xforce/xfdb/21793
http://www.ndmp.org/

Credit

This vulnerability was reported by Symantec.

This document was written by Jeff Gennari.

Other Information

Date Public	08/12/2005
Date First Published	08/12/2005 12:34:02 PM
Date Last Updated	01/12/2007
CERT Advisory
CVE-ID(s)	CVE-2005-2611
NVD-ID(s)	CVE-2005-2611
US-CERT Technical Alerts
Metric	36.98
Document Revision	107

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2005 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader