[NEWS] VERITAS NetBackup Remote Code Execution (COMMAND_LOGON_TO_MSERVER)

From: SecuriTeam (support_at_securiteam.com)
Date: 10/20/05

  • Next message: SecuriTeam: "[TOOL] Network Utilities from Bindshell" 
    To: list@securiteam.com
Date: 20 Oct 2005 12:05:18 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      VERITAS NetBackup Remote Code Execution (COMMAND_LOGON_TO_MSERVER)
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.veritas.com/Products/www?c=product&refId=2> VERITAS
    NetBackup Enterprise Server delivers high performance data protection that
    scales to protect the largest UNIX, Windows, Linux and NetWare
    environments."

    " <http://www.veritas.com/Products/www?c=product&refId=58> VERITAS
    NetBackup Server software is a cost-effective heterogeneous backup and
    recovery solution designed for mid-size organizations, workgroups, and
    remote offices."

    " <http://www.veritas.com/Products/www?c=product&refId=141> NetBackup
    Storage Migrator extends NetBackup with storage management that
    automatically stores data on the most appropriate media from creation to
    disposal; improving storage utilization, controlling data growth, and
    facilitating regulatory compliance."

    Lack of proper string filtering allow remote attackers to execute
    arbitrary code.

    DETAILS

    Vulnerable Systems:
     * VERITAS NetBackup Data and Business Center version 4.5FP
     * VERITAS NetBackup Data and Business Center version 4.5MP
     * VERITAS NetBackup Enterprise version 5.0
     * VERITAS NetBackup Server version 5.0
     * VERITAS NetBackup Client version 5.0
     * VERITAS NetBackup Enterprise version 5.1
     * VERITAS NetBackup Server version 5.1
     * VERITAS NetBackup Client version 5.1
     * VERITAS NetBackup Enterprise version 6.0
     * VERITAS NetBackup Server version 6.0
     * VERITAS NetBackup Client version 6.0

    This specific flaw exists within the bpjava-msvc daemon due to incorrect
    handling of format string data passed through the
    'COMMAND_LOGON_TO_MSERVER' command. The vulnerable daemon listens on TCP
    port 13722 and affects both NetBackup clients and servers.

    This vulnerability allows remote attackers to execute arbitrary code on
    vulnerable NetBackup installations. Authentication is not required to
    exploit this vulnerability.

    Vendor Status:
    Symantec Engineers have verified this issue and made security updates
    available for the supported VERITAS NetBackup products. Symantec strongly
    recommends all customers immediately apply the latest updates for their
    supported product versions to protect against these types of threats.
    Please refer to the Symantec advisory for update information:
    <http://www.symantec.com/avcenter/security/Content/2005.10.12.html>
    http://www.symantec.com/avcenter/security/Content/2005.10.12.html

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2715>
    CAN-2005-2715

    Disclosure Timeline:
    2005.09.12 Vulnerability reported to vendor
    2005.09.15 Digital Vaccine released to TippingPoint customers
    2005.10.11 Vulnerability information provided to ZDI security partners
    2005.10.12 Coordinated public release of advisory

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:zdi-disclosures@3com.com>
    zdi.
    The original article can be found at:
    <http://www.zerodayinitiative.com/advisories/ZDI-05-001.html>
    http://www.zerodayinitiative.com/advisories/ZDI-05-001.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] Network Utilities from Bindshell"

    Relevant Pages