Symantec Security Advisory

SYM06-006

27 March 2006

Veritas NetBackup (tm):  Multiple Overflow Vulnerabilities in NetBackup Daemons

Revision History
None

Severity
High (very configuration-dependent)

NOTE:  In recommended installations, Veritas NetBackup systems should always be restricted to trusted-host access. The Veritas NetBackup Server and clients should never be exposed external to the network.  While the servers and clients are still potentially susceptible to an insider-based attack, this greatly reduces the risk from unauthorized remote access through external, unauthenticated type of attacks.

 

Remote Access	Yes
Local Access	No
Authentication Required	Yes, if properly configured to authenticate connecting hosts and/or only accept connections from trusted / authorized hosts
Exploit publicly available	No

Overview
Multiple buffer overflow vulnerabilities have been identified in daemons running on Veritas NetBackup Master, Media Servers and clients.   An attacker, able to access a vulnerable Veritas NetBackup server or client and successfully exploit any of these issues, could potentially execute arbitrary code resulting in possible unauthorized, elevated privileged access to the targeted system.

Product(s) Affected
 

Product	Version	Build	Platform	Solution(s)
NetBackup Enterprise Server/NetBackup Server: Servers and Clients	6.0	All	All	6.0_MP2
NetBackup Enterprise Server/NetBackup Server: Servers and Clients	5.1	All	All	5.1_MP4_S01, 5.1_MP5
NetBackup Enterprise Server/NetBackup Server: Servers and Clients	5.0	All	All	5.0_MP6_S01, 5.0_MP7
NetBackup DataCenter and BusinesServer: Servers and Clients	4.5FP	All	All	4.5_FP9-S2
NetBackup DataCenter and BusinesServer: Servers and Clients	4.5MP	All	All	4.5_MP9_S2

Note:  Both 5.1 MP5 and 5.0 MP7, listed in the Solution section of this chart, will include the formal resolution to this issue and will be released as follows:
NetBackup Enterprise Server/Server 5.1 MP5 is currently scheduled for release the beginning of May, 2006.  
NetBackup Enterprise Server/Server 5.0 MP7 is currently scheduled for release in August, 2006.

In the interim, Symantec strongly recommends applying the Security Packs mentioned in the Solution section of the chart above for 5.0 and 5.1 (found below in the "Related Documents" section).

Please refer back to this document periodically, for any updates to the release information of 5.1 MP5 and 5.0 MP7.

Details
TippingPoint (http://tippingpoint.com), a division of 3Com, notified Symantec of multiple buffer overflow vulnerabilities identified in daemons running on Veritas NetBackup. The daemons identified were the volume manager (vmd) daemon and the NetBackup Catalog (bpdbm) daemon found on all supported NetBackup product versions and platforms and the NetBackup Sharepoint Services server (bpspsserver) daemon installed only with NetBackup 6.0 for Windows.

The overflows occur due to a failure to do proper input validation of incoming data.  A remote attacker who successfully gains network access to an affected system and successfully passes a specifically crafted packet through one of the supported protocol vectors to these vulnerable daemons could potentially execute arbitrary code with elevated privileges on the targeted system.  

Symantec Response
Symantec engineers have addressed these issues in all currently supported versions of NetBackup. Symantec engineers did additional reviews and will continue on-going reviews of related file functionality to further enhance the overall security of Veritas NetBackup products and to eliminate any additional potential concerns.

Security updates are available for all supported products. Symantec strongly recommends all customers immediately apply the latest cumulative Security Pack updates or Maintenance Pack releases as indicated for their supported product versions to protect against threats of this nature.

NOTE:  Security Packs (SPs) contain cumulative security fixes only.  The Maintenance Packs (MPs and FPs) contain cumulative security fixes as well as additional product enhancements and technical updates.

Symantec knows of no exploitation of or adverse customer impact from these issues.

The patches listed above for affected products are available for download below, in the Related Documents section.


Mitigations:

Implement NetBackup Access Control (NBAC) on NetBackup Servers and Clients
NBAC provides host-based authentication and user-level authorization through Veritas Security Services (VxSS) at both the server and the client to ensure communications are with a trusted host.

Disable/remove service for Microsoft Sharepoint Servers if not required
The bpspsserver daemon enabled by default on both servers and clients in the NetBackup 6.0 release, is used to support Microsoft SharePoint Servers on a network.  
If not required, disabling this service can be done by removing the service entirely or by deleting the config file found at:
<Install_Path>\NetBackup\var\vnetd\inetd_bpspsserver.txt.

Implement Trusted-Host access through configuration files
Daemons associated with Veritas NetBackup services provide Trusted-Host access through the appropriate configuration files. Some of the services allow access by default while others deny access by default depending on the functionality of the service.  Customers should follow the documentation provided for each service to ensure they have implemented a trusted-host relationship appropriate for their network.

The vmd, oprd and robotic daemons derive access control from the vm.conf file which allows access by default if there is no SERVER entry entered.

Using an appropriate text editor, configure vm.conf's "SERVER=<hostname>" for allowed host entries. Once a "SERVER=<hostname>" list is compiled, the associated daemons will ONLY trust and allow hosts annotated in vm.conf.  Any malicious user or attacker would have to have either authorized access to or to gain access to one of the trusted-hosts to attempt attacks against a targeted server.

All other daemons associated with Veritas NetBackup derive access control from the NetBackup configuration which denies access by default.
Edit the configuration using "host properties" in the GUI to allow only those hosts that require access to associated NetBackup services. Any malicious user or attacker would have to have either authorized access to or gain access to one of the trusted-hosts to attempt attacks against a targeted server.

IPS/IDS Signatures
Symantec Security Response has released IPS/IDS signatures to detect and prevent attempts to exploit this issue.

Symantec ManHunt 3.0 signatures are available for update from the Symantec Security Response Update Center at:
 http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_MH.html

Symantec Network Security Appliance 7100 signatures are available for update from the Symantec Security Response Update Center at:
 http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_SNS.html

Symantec Gateway Security 3.0 signatures are available for update from the Symantec Security Response Update Center at:
 http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_SGS.html

Symantec Client Security 2.0 and 3.0 signatures are available for update via LiveUpdate and from the Security Response Update Center at:
 http://www.symantec.com/avcenter/security/Content/Product/Product_SCS.html

Customers using Symantec Client Security 2.0 and 3.0 should receive frequent signature updates if they run LiveUpdate regularly.  If not, Symantec recommends customers manually run Symantec LiveUpdate to ensure they have the most current protection available.


Best Practices
As part of normal best practices, Symantec strongly recommends:

CVE
The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2006-0989 to the vmd overflow issue.
The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2006-0990 to the bpdbm overflow issue.
The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2006-0991 to the bpspsserver overflow issue.
These issues are candidates for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.

Credit:

Symantec thanks 3Com for reporting these issues and for providing full coordination under responsible disclosure while Symantec resolved them.