Arbitrary Code Execution Vulnerability in Veritas Backup Exec

CVE-2020-36167

Summary

A vulnerability in Veritas Backup Exec allows a low privileged user to leverage the OpenSSL library during service startup. By creating a malicious configuration file, an attacker can execute arbitrary code with SYSTEM privileges when the service starts. This not only grants full access to the affected system but can also compromise the entire Active Directory domain if the system is a domain controller. The issue primarily arises from the service attempting to load a potentially non-existent configuration file, leading to exploitation possibilities.

References