Issues

Issue 1: Arbitrary File Delete

The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perform arbitrary file deletion on protected files.

• CVE-ID: CVE-2024-33671
• Severity: High
• CVSS v3.1 Base Score 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
• Affected Versions:: 21.0, 21.1, 21,2, 21,3, 21.4, 22.0, 22.1, 22.2
• Recommended action: Upgrade to Version 23.0 (no HotFix needed) or
  Upgrade to version 22.2 and apply HotFix 917391 from the Download Center.
• Mitigation: Restrict access to the boost_interprocess directory (C:\ProgramData\boost_interprocess) to local administrator users only

Issue 2: Insecure DLL loading

Several issues involving loading of insecure DLLs were addressed in this advisory.

• CVE-ID: CVE-2024-33673
• Severity: High
• CVSS v3.1 Base Score 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
• Affected Versions:: 21.0, 21.1, 21,2, 21,3, 21.4, 22.0, 22.1, 22.2
• Recommended action: Upgrade to Version 23.0 (no HotFix needed) or
  Upgrade to version 22.2 and apply HotFix 917391 from the Download Center.

Mitigation:

• The issue is mitigated if non-admin Windows users DO NOT have access to create files in the DLL search path.
• Please see Microsoft documentation for DLL search order. https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order 

Acknowledgement

Veritas would like to thank the Lockheed Martin Red Team for notifying us about these issues.

Questions

For questions or problems regarding these vulnerabilities please contact Veritas Technical Support (https://www.veritas.com/support)

The information on this page is being provided to you on an "AS IS" and "AS-AVAILABLE" basis. The issues described on this page may or may not impact your system(s). Cloud Software Group, Inc. and its subsidiaries (collectively, "Cloud SG") make no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT AND FITNESS FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. BY ACCESSING THIS PAGE, YOU ACKNOWLEDGE THAT CLOUD SG SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. Cloud SG reserves the right to change or update the information on this page at any time. We accordingly recommend that you always view the latest version of this page. The information contained herein is being provided to you under the terms of your applicable customer agreement with Cloud SG, and may be used only for the purposes contemplated by such agreement. If you do not have such an agreement with Cloud SG, this information is provided under the cloud.com Terms of Use, and may be used only for the purposes contemplated by such Terms of Use.

The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perform arbitrary file deletion on protected files.

Several issues involving loading of insecure DLLs were addressed in this advisory.

Revision History

• 1.0: April 15, 2024: Initial version