Veritas Backup Exec Remote Agent for Windows Servers Authentication Buffer Overflow Vulnerability

Bugtraq ID:	14022
Class:	Boundary Condition Error
CVE:	CVE-2005-0773
Remote:	Yes
Local:	No
Published:	Jun 22 2005 12:00AM
Updated:	Nov 01 2007 08:36PM
Credit:	Discovery is credited to an anonymous source.
Vulnerable:	Veritas Software Backup Exec for Windows Servers 10.0 rev. 5484 SP1 Veritas Software Backup Exec for Windows Servers 10.0 rev. 5484 Veritas Software Backup Exec for Windows Servers 9.1 rev. 4691 SP2 Veritas Software Backup Exec for Windows Servers 9.1 rev. 4691 Veritas Software Backup Exec for Windows Servers 9.0 rev. 4454 SP1 Veritas Software Backup Exec for Windows Servers 9.0 rev. 4454 Veritas Software Backup Exec for Windows Servers 9.0 rev. 4367 SP1 Veritas Software Backup Exec for Windows Servers 9.0 rev. 4367 Veritas Software Backup Exec for NetWare Servers 9.1.1154 Veritas Software Backup Exec for NetWare Servers 9.1.1152 .4 Veritas Software Backup Exec for NetWare Servers 9.1.1152 Veritas Software Backup Exec for NetWare Servers 9.1.1151 .1 Veritas Software Backup Exec for NetWare Servers 9.1.1127 .1 Veritas Software Backup Exec for NetWare Servers 9.1.1067 .3 Veritas Software Backup Exec for NetWare Servers 9.1.1067 .2 Veritas Software Backup Exec for NetWare Servers 9.1.307 Veritas Software Backup Exec for NetWare Servers 9.1.306 Veritas Software Backup Exec for NetWare Servers 9.0.4202 Veritas Software Backup Exec for NetWare Servers 9.0.4174 Veritas Software Backup Exec for NetWare Servers 9.0.4172 Veritas Software Backup Exec for NetWare Servers 9.0.4170 Veritas Software Backup Exec for NetWare Servers 9.0.4019
Not Vulnerable:	Veritas Software Backup Exec for Windows Servers 10.0 rev. 5520 Veritas Software Backup Exec for NetWare Servers 9.1.1156

Veritas Backup Exec Remote Agent for Windows Servers Authentication Buffer Overflow Vulnerability

Veritas Backup Exec Remote Agent for Windows Servers is prone to a remotely exploitable buffer-overflow vulnerability. This issue occurs when handling authentication requests.

Successful exploits could allow attackers to execute arbitrary code.

Veritas Backup Exec Remote Agent for Windows Servers Authentication Buffer Overflow Vulnerability

An exploit (backupexec_agent.pm) has been released as part of the Metasploit Framework project.

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

• /data/vulnerabilities/exploits/backupexec_agent.pm

Veritas Backup Exec Remote Agent for Windows Servers Authentication Buffer Overflow Vulnerability

Solution:
Fixes are available. Please see the references for details.


Veritas Software Backup Exec for Windows Servers 10.0 rev. 5484

• Veritas Software Q175168.BEWS10.0.5520.ESD_277181.zip
  http://support.veritas.com/docs/277181

Veritas Software Backup Exec for Windows Servers 10.0 rev. 5484 SP1

• Veritas Software be5484RHF24_275514.exe
  http://support.veritas.com/docs/275514

Veritas Software Backup Exec for Windows Servers 9.0 rev. 4367 SP1

• Veritas Software be4367RHF21_276156.exe
  http://support.veritas.com/docs/276156

Veritas Software Backup Exec for Windows Servers 9.0 rev. 4454 SP1

• Veritas Software be4454RHF31_275911.exe
  http://support.veritas.com/docs/275911

Veritas Software Backup Exec for NetWare Servers 9.0.4202

• Veritas Software B904202HF1_277423.EXE
  http://support.veritas.com/docs/277423

Veritas Software Backup Exec for Windows Servers 9.1 rev. 4691 SP2

• Veritas Software be4691RHF52_275909.exe
  http://support.veritas.com/docs/275909

Veritas Backup Exec Remote Agent for Windows Servers Authentication Buffer Overflow Vulnerability

References:

• Veritas Backup Exec Agent CONNECT_CLIENT_AUTH Buffer Overflow Vulnerability (iDEFENSE)
  
• Vulnerability Note VU#492105 (CERT)
  
• VX05-002 VERITAS Backup Exec Remote Agent for Windows Servers Buffer Overflow (Veritas Software)