Vulnerability Note VU#492105

VERITAS Backup Exec is a data backup and recovery solution with support for over the network backup. The VERITAS Backup Exec Agent runs on systems to be backed up listening on TCP port 10000 and is responsible for accepting connections from the backup server when a backup is to occur.

The Backup Exec Remote Agent for Windows Servers contains a buffer overflow vulnerability due to incorrect validation on authentication requests, allowing a remote attacker to execute arbitrary code.

For more details on the vulnerability, see the iDefense security advisory:

http://www.idefense.com/application/poi/display?id=272&type=vulnerabilities.

VERITAS Software Security Advisory VX05-002 available from http://seer.support.veritas.com/docs/276604.htm.

http://seer.support.veritas.com/docs/277428.htm.

A remote attacker can execute arbitrary code on computers where the Remote Agent is installed and gain administrative control. As the Backup Exec Remote Agent may be running on workstations as well as servers, this vulnerability may provide greater opportunity for attack than the other vulnerabilities identified above.

Apply a patch from the vendor. See http://seer.support.veritas.com/docs/276604.htm for details.

Workaround

Use firewalls to limit connectivity so that only the backup server(s) can connect to the systems being backed up. The standard port for this service is port 10000.

At minimum, some basic protection should be in effect at the network boundaries. Individual installations may operate on nonstandard ports, which should be taken into account when developing network traffic filtering rules.

Note: even if patching can be done quickly, the above workaround measures should be considered as part of a defense-in-depth strategy for protecting your systems.