US-CERT issues warning about new VERITAS Backup Exec vulnerability

US-CERT has released the following warning concerning the VERITAS Backup Exec Remote Agent for Windows Servers.

VERITAS Backup Exec Remote Agent for Windows Servers uses hard-coded administrative authentication credentials. An attacker with knowledge of these credentials and access to the Remote Agent could retrieve arbitrary files from a vulnerable system.

Description
VERITAS Backup Exec Remote Agent for Windows Servers is a data backup and recovery solution that supports the Network Data Management Protocol (NDMP). NDMP "...is an open standard protocol for enterprise-wide backup of heterogeneous network-attached storage." By default, the Remote Agent listens for NDMP traffic on port 10000/tcp.

The VERITAS Backup Exec Remote agent uses hard-coded administrative authentication credentials. An attacker with knowledge of these credentials and access to the Remote Agent may be able to retrieve arbitrary files from a vulnerable system. The Remote Agent runs with SYSTEM privileges.

Exploit code, including the credentials, is publicly available. US-CERT has also seen reports of increased scanning activity on port 10000/tcp. This increase may be caused by attempts to locate vulnerable systems.

US-CERT is tracking this vulnerability as VU#378957.

Please note that VERITAS has recently merged with Symantec.

Impact
A remote attacker with knowledge of the credentials and access to the Remote Agent may be able to retrieve arbitrary files from a vulnerable system.

Solution : restrict access

US-CERT recommends taking the following actions to reduce the chances of exploitation:

* Use firewalls to limit connectivity so that only authorized backup server(s) can connect to the Remote Agent. The default port for this service is port 10000/tcp.

* At a minimum, implement some basic protection at the network perimeter. When developing rules for network traffic filters, realize that individual installations may operate on non-standard ports.

* In addition, changing the Remote Agent's default port from 10000/tcp may reduce the chances of exploitation. Please refer to VERITAS support document 255174 for instructions on how to change the default port.

•Date: 16th August 2005 • Region: US• Type: Article •Topic: Warnings
Rate this article or make a comment - click here