SYM06-014

31 July 2006

Backup Exec:  RPC Interface Heap Overflow, Authorized User Potential Elevation of Privilege

Revision History
None

Severity
Medium

 

Property	Yes/No
Remote Access	Yes
Local Access	No
Authentication Required	Yes
Exploit publicly available	No

Overview

Backup Exec for Windows Servers, Continuous Protection Server Remote Agent, and other Backup Exec Remote Agents are vulnerable to heap overflows from specifically formatted calls to RPC interfaces.

Supported Products Affected
 

Product	Version	Build	Solution(s)
Backup Exec for Windows Server and Remote Agent	9.1	9.1.4691	Hotfix Available
Backup Exec for Windows Server and Remote Agent	10.0	10.0.5484	Hotfix Available
Backup Exec for Windows Server and Remote Agent	10.0	10.0.5520	Hotfix Available
Backup Exec for Windows Server and Remote Agent	10.1	10.1.5629	Hotfix Available
Backup Exec Continuous Protection Server Remote Agent for Windows Server	10.1	10.1.325.6301	Hotfix Available
Backup Exec Continuous Protection Server Remote Agent for Windows Server	10.1	10.1.326.1401	Hotfix Available
Backup Exec Continuous Protection Server Remote Agent for Windows Server	10.1	10.1.326.2501	Hotfix Available
Backup Exec Continuous Protection Server Remote Agent for Windows Server	10.1	10.1.326.3301	Hotfix Available
Backup Exec Continuous Protection Server Remote Agent for Windows Server	10.1	10.1.327.401	Hotfix Available

Note: Only the products and versions listed above are affected by these issues. Product versions prior to those listed above are not supported. Customers running legacy product versions should upgrade to a supported version of Backup Exec and apply all available updates.


Details

Tenable Network Security,  http://www.tenablesecurity.com/ , notified Symantec of heap overflow issues they identified in the RPC interfaces of Backup Exec for Windows Servers and associated remote agents. The overflows occur due to improper validation and the subsequent handling of input. Successful exploitation would require the attacker to have authorized but non-privileged access to the network on which the target system resides. A malicious user who attempted such an attack may cause the targeted application to crash, or more rarely could execute arbitrary code to gain elevated privilege on the targeted system.

Symantec Response

Symantec engineers did in-depth reviews of the reported issue and related file functionality to further enhance the overall security of Symantec Backup Exec products and to eliminate any additional concerns. Symantec engineers have at this time addressed the issue in all currently supported versions of the identified products.

Security updates are now available for all supported products. Symantec strongly recommends all customers apply the latest security update as indicated for their supported product versions to protect against threats of this nature.

Symantec knows of no exploitation or adverse customer impact from these issues.


Hotfixes for the affected products are available from the following locations:

 http://support.veritas.com/docs/284447

 http://support.veritas.com/docs/284433

 http://support.veritas.com/docs/284429

 http://support.veritas.com/docs/284432

 http://support.veritas.com/docs/284241

Note: The Backup Exec for NetWare Servers Remote Agent for Windows Servers is also vulnerable to heap overflows from specifically formatted calls to RPC interfaces. For full details and a complete list of affected Backup Exec for NetWare Servers products and patches developed to address these issues in those products, please see the following associated Backup Exec for NetWare Servers Security Advisory:

 http://support.veritas.com/docs/284623

Best Practices

As part of normal best practices, Symantec recommends:

CVE

A CVE Candidate name has been requested from the Common Vulnerabilities and Exposures (CVE) initiative for this issue. This advisory will be revised accordingly upon receipt of the CVE Candidate name.
This issue is a candidate for inclusion in the CVE list,  http://cve.mitre.org , which standardizes names for security problems.

Credit

Symantec thanks Nicolas Pouvesle from Tenable Network Security for reporting this finding to us and for excellent coordination while resolving the issue.