The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Veritas Backup Exec Agent Browser Registration Request Buffer Overflow
------------------------------------------------------------------------
SUMMARY
<http://veritas.com/Products/www?c=product&refId=57> Backup Exec is a
next generation backup and restore solution for Microsoft Windows server
environments.
Remote exploitation of a stack-based buffer overflow vulnerability in
Veritas Backup Exec allows attackers to execute arbitrary code.
DETAILS
Vulnerable Systems:
* Veritas Backup Exec Agent version 9.1 for Windows
Immune Systems:
* Veritas Backup Exec Agent version 9.1.4691 Hotfix 40
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1172>
CAN-2004-1172 - Browser Registration Request Buffer Overflow
The vulnerability exists within the function responsible for receiving and
parsing registration requests. The registration request packet contains
the hostname and connecting TCP port of the client which is stored in an
array on the stack. An attacker can send a registration request with an
overly long hostname value to overflow the array and take control of the
saved return address, thereby executing arbitrary code.
Impact
Successful exploitation does not require authentication thereby allowing
any remote attacker to execute arbitrary code under the privileges of the
Backup Exec Agent Browser (benetns.exe) process which is usually a domain
administrative account.
Workaround
Use a firewall to restrict incoming connections to trusted workstations
running the Backup Exec client software.
Vendor Status:
The vendor has released a hotfix that addresses this vulnerability.
8.60.3878 Hotfix 68 - Backup Exec (Buffer overflow creates a security hole
in Agent Browser):
<http://seer.support.veritas.com/docs/273422.htm>
http://seer.support.veritas.com/docs/273422.htm
9.1.4691 Hotfix 40 - Backup Exec (Buffer overflow creates a security hole
in Agent Browser; Licensed Storage Central becomes Eval when Backup Exec
9.1 is uninstalled)
<http://seer.support.veritas.com/docs/273420.htm>
http://seer.support.veritas.com/docs/273420.htm
Note: Requires Backup Exec 9.1.4691 Service Pack 1.
Disclosure Timeline:
11/02/2004 - Initial vendor contact
12/16/2004 - Initial vendor response
12/16/2004 - Public disclosure
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDEFENSE Security Labs.
The original article can be found at:
<http://www.idefense.com/application/poi/display?id=169>
http://www.idefense.com/application/poi/display?id=169
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
