CVE-2020-36169 : Exploit Details and Defense Strategies

An issue was discovered in Veritas NetBackup through 8.3.0.1 and OpsCenter through 8.3.0.1 where processes using OpenSSL attempt to load and execute libraries from paths that do not exist by default on the Windows operating system, potentially allowing arbitrary code execution as SYSTEM or Administrator.

Understanding CVE-2020-36169

This CVE identifies a vulnerability in Veritas NetBackup and OpsCenter that could lead to privilege escalation on Windows systems.

What is CVE-2020-36169?

The vulnerability arises from the ability of low-privileged users to create directories with specific libraries that the Veritas products attempt to load, enabling unauthorized code execution as SYSTEM or Administrator.

The Impact of CVE-2020-36169

The severity of this vulnerability is rated as Critical with a CVSS base score of 9.3. The impact includes high confidentiality and integrity risks, with the potential for an attacker to gain administrator access.

Technical Details of CVE-2020-36169

Processes using OpenSSL in Veritas NetBackup and OpsCenter are susceptible to loading and executing non-existent libraries on Windows systems.

Vulnerability Description

The issue allows attackers to execute arbitrary code as SYSTEM or Administrator by creating specific paths with malicious libraries.

Affected Systems and Versions

Veritas NetBackup through 8.3.0.1
OpsCenter through 8.3.0.1

Exploitation Mechanism

Attackers can exploit this vulnerability by creating directories with malicious libraries that the Veritas products attempt to load, leading to unauthorized code execution.

Mitigation and Prevention

To address CVE-2020-36169, follow these steps:

Immediate Steps to Take

Apply vendor-supplied patches promptly.
Monitor for any unauthorized system access.

Long-Term Security Practices

Implement the principle of least privilege to restrict user capabilities.
Regularly update and patch software to mitigate known vulnerabilities.

Patching and Updates

Ensure that Veritas NetBackup and OpsCenter are updated to versions that address this vulnerability.