Revision History

  • 1.0: December 23, 2020: Initial version
  • 1.1: January 8, 2021: Added CVE ID
  • 1.2: February 17, 2021: Added Mitigation section

Summary

As part of our ongoing testing process Veritas has discovered an issue where Veritas System Recovery (VSR) could allow an attacker to run arbitrary code with administrator privilege.

Issue

CVE ID: CVE-2020-36160
Severity: Critical
CVSS v3.1 Base Score: 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

On start-up, the Veritas System Recovery (VSR) application loads the OpenSSL library from \usr\local\ssl. This library attempts to load the from \usr\local\ssl\openssl.cnf configuration file which does not exist. By default, on Windows systems, users can create directories under C:\. A low privileged user on the Windows system without any privileges in VSR can create a C:\usr\local\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, to access all installed applications, etc. If the system is also an Active Directory domain controller then this can affect the entire domain.

Affected Versions

Veritas System Recovery (VSR) Windows versions 21.1, 21, 18.0.4, 18.0.3, 18.0.2, 18.0.1, 18.0, 16.0.2, 16.0.1 and 16. Earlier unsupported versions may be affected as well.

Non-Windows platforms are not affected.

Remediation

Customers under a current maintenance contract can download and install Veritas System Recovery (VSR) 21.2 to fix the vulnerability.

Mitigation

If not applying a recommended remediation listed above, use an administrator account to create the directory ‘\usr\local\ssl’ under root of all drives and set the ACL on the directory to deny write access to all other users. This will prevent an attacker from installing a malicious OpenSSL engine.

See the Veritas Download Center for available updates: https://www.veritas.com/support/en_US/downloads

Questions

For questions or problems regarding these vulnerabilities please contact Veritas Technical Support (https://www.veritas.com/support).