Description
Stack-based buffer overflow in the Agent Browser in Veritas Backup Exec 8.x before 8.60.3878 Hotfix 68, and 9.x before 9.1.4691 Hotfix 40, allows remote attackers to execute arbitrary code via a registration request with a long hostname.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Veritas Backup Exec Name Service Overflow
exploit/windows/backupexec/name_service
Exploit-DB 2
- Veritas Backup Exec Name Service - Remote Overflow (Metasploit) EDB-16331 · remote · Jun 22, 2010 · verified
- Veritas Backup Exec Agent 8.x/9.x - Browser Overflow EDB-750 · remote · Jan 11, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://seer.support.veritas.com/docs/273419.htm
- http://www.frsirt.com/exploits/20050111.101_BXEC.cpp.php
- 11974 vdb-entry
- http://seer.support.veritas.com/docs/273850.htm
- VU#907729 third-party-advisory
- http://seer.support.veritas.com/docs/273422.htm
- 13495 third-party-advisory
- netbackup-agent-browser-bo(18506) vdb-entry
- http://seer.support.veritas.com/docs/273420.htm
- 20041216 Veritas Backup Exec Agent Browser Registration Request Buffer Overflow Vulnerability third-party-advisory