Actively exploited in the wild
Veritas Backup Exec Agent File Access Vulnerability
Veritas - Backup Exec Agent · Listed in the CISA KEV since 2023-04-07. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-27876
HighCVSS 8.1KEVSummary
A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2. An attacker can gain unauthorized access and, using crafted input parameters, access an arbitrary file on the system with System privileges.
Risk Assessment
An attacker could access arbitrary files on the system, potentially leading to data leakage or further privilege escalation.
Recommendation
Update Veritas Backup Exec to version 21.2 or later.
Other vulnerabilities in Veritas Backup Exec
See all- CVE-2021-27878HighActively exploited
A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2. An attacker can gain unauthorized access and execute arbitrary commands with system privileges.
- CVE-2021-27877HighActively exploited
A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2, which had not been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.
- CVE-2017-8895Critical
In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution.
Original NVD description (English source)
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.