Arbitrary Code Execution Vulnerability in Veritas System Recovery by Veritas
CVE-2020-36160

9.3CRITICAL

Key Information:

Vendor

Veritas

Status
System Recovery
Vendor
CVE Published:
6 January 2021

What is CVE-2020-36160?

A vulnerability in Veritas System Recovery prior to version 21.2 allows a low privileged user to create a malicious configuration file that can load an arbitrary OpenSSL engine. This occurs during service startup, potentially granting SYSTEM-level access and leading to arbitrary code execution. This weakness poses a significant risk, particularly for users on Windows systems where directory creation is commonly allowed. If exploited, an attacker may gain unfettered access to sensitive data and installed applications, with the possibility of impacting the entire domain if the system serves as an Active Directory controller.

References

https://www.veritas.com/content/support/en_US/security/VT...
x_refsource_MISC

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.