OSVDB ID: 17624

Title: VERITAS Backup Exec Remote Agent for Windows CONNECT_CLIENT_AUTH Remote Overflow

Info

Disclosure

Jun 22, 2005

Discovery

Unknown

Dates

Exploit

Jun 22, 2005

Solution

Unknown

Description

A remote overflow exists in Backup Exec Remote Agent for Windows. The issue occurs when a client authentication request is received with type '3' and a long password argument. Reliable execution is obtained by abusing the stack overflow to smash a SEH pointer resulting in a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Upgrade to the correct version supplied by the vendow, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Veritas	Backup Exec Remote Agent for Windows	9.0
		9.1
		10.0
		4.2 for NT

References

Security Tracker: 1014273
Bugtraq ID: 14022
Secunia Advisory ID: 15789
CVE ID: 2005-0773 (see also: NVD)
CERT VU: 492105
Mail List Post: http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0073.html
Vendor Specific Advisory URL: http://seer.support.veritas.com/docs/276604.htm
http://www.hitachi-support.com/security_e/vuls_e/HS05-014_e/index-e.html
Other Advisory URL: http://www.idefense.com/application/poi/display?id=272&type=vulnerabilities
Generic Informational URL: http://www.informationweek.com/story/showArticle.jhtml?articleID=164903957
Generic Exploit URL: http://www.metasploit.org/projects/Framework/exploits.html#backupexec_agent
http://www.securiteam.com/exploits/5MP0R20G0S.html
Keyword: RAWS VX05-002

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/36218

Info

Disclosure

Discovery

Dates

Exploit

Solution

Description

Classification

Solution

Products

Veritas

Backup Exec Remote Agent for Windows

References

Credit