Arbitrary Code Execution Vulnerability in Veritas Backup Exec

CVE-2020-36167

What is CVE-2020-36167?

A vulnerability in Veritas Backup Exec allows a low privileged user to leverage the OpenSSL library during service startup. By creating a malicious configuration file, an attacker can execute arbitrary code with SYSTEM privileges when the service starts. This not only grants full access to the affected system but can also compromise the entire Active Directory domain if the system is a domain controller. The issue primarily arises from the service attempting to load a potentially non-existent configuration file, leading to exploitation possibilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References