// For flags

CVE-2021-27876

Veritas Backup Exec Agent File Access Vulnerability

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

Yes
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.

Se detectó un problema en Veritas Backup Exec versiones anteriores a 21.2. La comunicación entre un cliente y un agente requiere una autenticación con éxito, que generalmente se completa por medio de una comunicación TLS segura. Sin embargo, debido a una vulnerabilidad en el esquema de autenticación SHA, un atacante puede conseguir acceso no autorizado y completar el proceso de autenticación. Posteriormente, el cliente puede ejecutar comandos de protocolo de gestión de datos en la conexión autenticada. Mediante el uso de parámetros de entrada diseñados en uno de estos comandos, un atacante puede acceder a un archivo arbitrario en el sistema utilizando privilegios system

Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-03-01 CVE Reserved
  • 2021-03-01 CVE Published
  • 2021-03-01 First Exploit
  • 2023-04-07 Exploited in Wild
  • 2023-04-28 KEV Due Date
  • 2024-07-04 EPSS Updated
  • 2024-08-03 CVE Updated
CWE
  • CWE-287: Improper Authentication
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Veritas
Search vendor "Veritas"
 Backup Exec
Search vendor "Veritas" for product "Backup Exec"
 < 21.2
Search vendor "Veritas" for product "Backup Exec" and version " < 21.2"
-
Affected