CVE-2020-36165 : What You Need to Know

An issue was discovered in Veritas Desktop and Laptop Option (DLO) before 9.4, allowing a low privileged user to execute arbitrary code as SYSTEM, potentially leading to administrator access on the system.

Understanding CVE-2020-36165

This CVE describes a vulnerability in Veritas Desktop and Laptop Option (DLO) that could result in arbitrary code execution.

What is CVE-2020-36165?

The vulnerability in Veritas DLO allows a low privileged user to create a malicious OpenSSL engine configuration file, leading to arbitrary code execution as SYSTEM during service startup.

The Impact of CVE-2020-36165

The impact of this vulnerability is rated as critical with a CVSS base score of 9.3. It can result in high confidentiality, integrity, and availability impacts, potentially granting an attacker administrator access on the system.

Technical Details of CVE-2020-36165

This section provides more technical insights into the vulnerability.

Vulnerability Description

The issue arises from the loading of the OpenSSL library from a specific directory, allowing the user to create a malicious configuration file for arbitrary code execution.

Affected Systems and Versions

Veritas Desktop and Laptop Option (DLO) versions before 9.4 are affected.

Exploitation Mechanism

The vulnerability can be exploited by creating a specific configuration file in the OpenSSL library directory, leading to code execution as SYSTEM.

Mitigation and Prevention

Protecting systems from this vulnerability requires immediate actions and long-term security practices.

Immediate Steps to Take

Apply the latest security patches provided by Veritas to mitigate the vulnerability.
Monitor system logs for any suspicious activities related to unauthorized file creations.

Long-Term Security Practices

Implement the principle of least privilege to restrict user capabilities and access rights.
Conduct regular security audits and penetration testing to identify and address potential vulnerabilities.

Patching and Updates

Regularly update and patch the Veritas DLO software to ensure the latest security fixes are in place.