Issue

CVE ID: CVE-2024-35204
Severity: High
CVSS v3.1 Base Score 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CWE-272: Least Privilege Violation

Prerequisites

When Backup Exec System Recovery service is running, it logs information into C:\ProgramData\Veritas\VERITAS SYSTEM RECOVERY\LOGS\Veritas System Recovery.log.txt file with NT Authority\System permission. The file is not exclusively opened, nor protected, and can be deleted at any time. The C:\ProgramData\Veritas\VERITAS SYSTEM RECOVERY\LOGS directory is modifiable by low privileged Windows system user, thus can be transformed into a directory junction and symbolic link.

Affected Versions

Backup Exec System Recovery versions 23.3, 23.2, 23.1, 23.0, 22.0, 21.3, 21.2, 21.1, 21.0 (Earlier unsupported versions of Veritas System Recovery may be affected as well)

Affected Software

The vulnerable service is Backup Exec System Recovery ("C:\Program Files\Veritas\Veritas System Recovery\Agent\VProSvc.exe")

Remediation

Customers under a current maintenance contract who are running in low privilege user mode should execute the script available from the Backup Exec Download Center under Updates section (Hotfix 860045) https://supportbackupexec.cloud.com/support-home/home (Kindly login using your credentials to get access to downloads)

For further information, refer to Backup Exec document (Article - 100065391)

• https://supportbackupexec.cloud.com/support-home/home  (Kindly login using your credentials to get access to downloads)

Questions

For questions or problems regarding these vulnerabilities please contact Backup Exec Technical Support (https://supportbackupexec.cloud.com/support-home/home)

The information on this page is being provided to you on an "AS IS" and "AS-AVAILABLE" basis. The issues described on this page may or may not impact your system(s). Cloud Software Group, Inc. and its subsidiaries (collectively, "Cloud SG") make no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT AND FITNESS FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. BY ACCESSING THIS PAGE, YOU ACKNOWLEDGE THAT CLOUD SG SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. Cloud SG reserves the right to change or update the information on this page at any time. We accordingly recommend that you always view the latest version of this page. The information contained herein is being provided to you under the terms of your applicable customer agreement with Cloud SG, and may be used only for the purposes contemplated by such agreement. If you do not have such an agreement with Cloud SG, this information is provided under the cloud.com Terms of Use, and may be used only for the purposes contemplated by such Terms of Use.

A vulnerability was discovered in the Backup Exec System Recovery 23.0 (23.0.2.63015), and prior. Arbitrary file creation is a vulnerability that allows attacker with low privilege Windows system user to create file in arbitrary location within filesystem. This includes protected directories, such as C:\Windows, C:\windows\system32 and "C:\Program Files". In addition, Attacker could leverage this vulnerability to cause denial of service or tampering the important service (e.g., backup service) with low privilege user account.

Revision History

• 1.0: May 07, 2024: Initial version
• 1.1: May 14, 2024: Added CVE ID
• 1.2: September 20, 2024: Version added to Affected Versions
• 1.3: September 26, 2024: Update Remediation plan