Veritas Backup Exec Remote Agent 16.x < 21.2 Multiple Vulnerabilities (VTS21-001)

critical Nessus Plugin ID 146990

Language:

Synopsis

A remote data protection agent installed on the remote host is affected by multiple vulnerabilities.

Description

The version of Veritas Backup Exec Remote Agent installed on the remote Windows host is 16.x prior to 21.2. It is, therefore, affected by multiple vulnerabilities, as follows:

- An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges. (CVE-2021-27876)

- An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands. (CVE-2021-27877)

- An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges. (CVE-2021-27878)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Veritas Backup Exec Remote Agent version 21.2 or later.

Plugin Details

Severity: Critical

ID: 146990

File Name: veritas_backup_exec_remote_agent_VTS21-001.nasl

Version: 1.9

Type: local

Agent: windows

Family: Windows

Published: 3/3/2021

Updated: 5/2/2024

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2021-27878

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS Score Source: CVE-2021-27877

Vulnerability Information

CPE: cpe:/a:veritas:backup_exec_remote_agent

Required KB Items: installed_sw/Veritas Backup Exec Remote Agent, SMB/Registry/Enumerated

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/1/2021

Vulnerability Publication Date: 3/1/2021

CISA Known Exploited Vulnerability Due Dates: 4/28/2023

Exploitable With

Metasploit (Veritas Backup Exec Agent Remote Code Execution)

Reference Information

CVE: CVE-2021-27876, CVE-2021-27877, CVE-2021-27878

IAVA: 2021-A-0115-S

Detections

Analytics