Veritas Backup Exec For Windows And NetWare Arbitrary File Download Vulnerability

Bugtraq ID:	14551
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 12 2005 12:00AM
Updated:	Aug 12 2005 12:00AM
Credit:	The discoverer of this vulnerability wishes to remain anonymous.
Vulnerable:	Veritas Software NetBackup for NetWare Media Servers 5.1 MP3 Veritas Software NetBackup for NetWare Media Servers 5.1 MP2 Veritas Software NetBackup for NetWare Media Servers 5.1 MP1 Veritas Software NetBackup for NetWare Media Servers 5.1 Veritas Software NetBackup for NetWare Media Servers 5.0 MP5 Veritas Software NetBackup for NetWare Media Servers 5.0 MP4 Veritas Software NetBackup for NetWare Media Servers 5.0 MP3 Veritas Software NetBackup for NetWare Media Servers 5.0 MP2 Veritas Software NetBackup for NetWare Media Servers 5.0 MP1 Veritas Software NetBackup for NetWare Media Servers 5.0 Veritas Software NetBackup for NetWare Media Servers 4.5 MP8 Veritas Software NetBackup for NetWare Media Servers 4.5 MP7 Veritas Software NetBackup for NetWare Media Servers 4.5 MP6 Veritas Software NetBackup for NetWare Media Servers 4.5 MP5 Veritas Software NetBackup for NetWare Media Servers 4.5 MP4 Veritas Software NetBackup for NetWare Media Servers 4.5 MP3 Veritas Software NetBackup for NetWare Media Servers 4.5 MP2 Veritas Software NetBackup for NetWare Media Servers 4.5 MP1 Veritas Software NetBackup for NetWare Media Servers 4.5 FP8 Veritas Software NetBackup for NetWare Media Servers 4.5 FP7 Veritas Software NetBackup for NetWare Media Servers 4.5 FP6 Veritas Software NetBackup for NetWare Media Servers 4.5 FP5 Veritas Software NetBackup for NetWare Media Servers 4.5 FP4 Veritas Software NetBackup for NetWare Media Servers 4.5 FP3 Veritas Software NetBackup for NetWare Media Servers 4.5 FP2 Veritas Software NetBackup for NetWare Media Servers 4.5 FP1 Veritas Software NetBackup for NetWare Media Servers 4.5 Veritas Software Backup Exec Remote Agent for Windows Server Veritas Software Backup Exec Remote Agent for Unix/Linux Server Veritas Software Backup Exec Remote Agent for NetWare Server Veritas Software Backup Exec for Windows Servers 10.0 rev. 5520 Veritas Software Backup Exec for Windows Servers 10.0 rev. 5484 SP1 Veritas Software Backup Exec for Windows Servers 10.0 rev. 5484 Veritas Software Backup Exec for Windows Servers 9.1 rev. 4691 SP2 Veritas Software Backup Exec for Windows Servers 9.1 rev. 4691 Veritas Software Backup Exec for Windows Servers 9.1 Veritas Software Backup Exec for Windows Servers 9.0 rev. 4454 SP1 Veritas Software Backup Exec for Windows Servers 9.0 rev. 4454 Veritas Software Backup Exec for Windows Servers 9.0 rev. 4367 SP1 Veritas Software Backup Exec for Windows Servers 9.0 rev. 4367 Veritas Software Backup Exec for Windows Servers 9.0 Veritas Software Backup Exec for Windows Servers 8.6 Veritas Software Backup Exec for NetWare Servers 9.1.1156 Veritas Software Backup Exec for NetWare Servers 9.1.1154 Veritas Software Backup Exec for NetWare Servers 9.1.1152 .4 Veritas Software Backup Exec for NetWare Servers 9.1.1152 Veritas Software Backup Exec for NetWare Servers 9.1.1151 .1 Veritas Software Backup Exec for NetWare Servers 9.1.1127 .1 Veritas Software Backup Exec for NetWare Servers 9.1.1067 .3 Veritas Software Backup Exec for NetWare Servers 9.1.1067 .2 Veritas Software Backup Exec for NetWare Servers 9.1.307 Veritas Software Backup Exec for NetWare Servers 9.1.306 Veritas Software Backup Exec for NetWare Servers 9.0.4202 Veritas Software Backup Exec for NetWare Servers 9.0.4174 Veritas Software Backup Exec for NetWare Servers 9.0.4172 Veritas Software Backup Exec for NetWare Servers 9.0.4170 Veritas Software Backup Exec for NetWare Servers 9.0.4019
Not Vulnerable:

Veritas Backup Exec For Windows And NetWare Arbitrary File Download Vulnerability

Veritas Backup Exec for Windows Servers, Veritas Backup Exec for NetWare Servers, NetBackup for NetWare Media Server Option, and Remote Agents for Windows, Unix/Linux, and NetWare servers are prone to a vulnerability regarding the unauthorized downloading of arbitrary files.

A remote attacker can exploit this vulnerability to download arbitrary files, aiding them in further attack.

A Metasploit Framework exploit is available and there are reports of this vulnerability currently being exploited in the wild.

Veritas Backup Exec For Windows And NetWare Arbitrary File Download Vulnerability

The following metasploit framework exploit is available:

• /data/vulnerabilities/exploits/backupexec_dump.pm

Veritas Backup Exec For Windows And NetWare Arbitrary File Download Vulnerability

Solution:
Fixes are available. Please see the referenced advisory SYM05-011 for further details.

Veritas Backup Exec For Windows And NetWare Arbitrary File Download Vulnerability

References:

• Backup Product Homepage (Veritas)
  
• SYM05-011 - VERITAS Backup Exec for Windows Servers, VERITAS Backup Exec for Net (Symantec)
  
• Veritas Homepage (Veritas Software)
  
• VU#378957 - VERITAS Backup Exec Remote Agent for Windows Servers contains hard-c (US-CERT)