US-CERT: Veritas Vulnerability Exploited By Sean Michael Kerner http://www.internetnews.com/ent-news/article.php/3516906
The Department of Homeland Security's (DHS) US-CERT (Computer Emergency Readiness Team) issued an alert stating that Veritas Backup Exec Software is being actively exploited. The Technical Cyber Security Alert comes a week after the first public disclosure of the Veritas vulnerability. The active exploitation of Veritas' Backup Exec software is the result of a buffer overflow condition that could potentially allow a malicious remote user to execute arbitrary code. The buffer overflow is triggered by a flaw in how the remote agent software validates incoming packets. Veritas Backup Exec software is a network enabled recovery and backup solution that listens on TCP port 10000 for incoming connections. Veritas software is shipped by a number of vendors, including NEC and Hitachi. Security research firm iDefense first discovered the flaw in March and issued a joint public disclosure with Veritas on June 22. According to the iDefense advisory the exploitation does not require authentication and can occur, "fairly reliably since the overflow is able to control code execution via the structured exception handler." According to Michael Sutton, director of iDefense Labs, a public exploit came out for this vulnerability last Friday. "Over the weekend we noticed increased port scanning on port 10000 so it's safe to assume that the two are related," Sutton told internetnews.com. "This vulnerability was relatively easy to exploit so it's not surprising that a public exploit emerged following the coordinated public disclosure." US-CERT confirmed an increased scanning activity on port 10000/tcp and that exploit code is publicly available. "This increase is believed to be attempts to locate vulnerable systems running the Veritas Backup Exec Remote Agent," the alert states. Veritas issued a hotfix patch at the time of the joint public disclosure of the vulnerability by iDefense and Veritas. Veritas claimed in its advisory that it was "unaware of any adverse customer impact from this issue". Users were strongly recommended to update their software with the hotfix. "The patch does fix the vulnerability," Sutton said. "We were able to work with the vendor ahead of time and assist in testing the patch." US-CERT and iDefense have also recommended that users implement some form of firewall network perimeter protection to restrict incoming connections to only trusted workstations. You are a subscribed member of the infowarrior list. Visit www.infowarrior.org for list information or to unsubscribe. This message may be redistributed freely in its entirety. Any and all copyrights appearing in list messages are maintained by their respective owners.
