Description
In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution. An unauthenticated attacker can use this vulnerability to crash the agent or potentially take control of the agent process and then the system it is running on.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Veritas/Symantec Backup Exec SSL NDMP Connection Use-After-Free
exploit/windows/backupexec/ssl_uaf
Exploit-DB 1
- Veritas/Symantec Backup Exec - SSL NDMP Connection Use-After-Free (Metasploit) EDB-42282 · remote · Jun 29, 2017 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 98386 vdb-entry
- https://www.veritas.com/content/support/en_US/security/VTS17-006.html#Issue1
- 1038561 vdb-entry
- 42282 exploit