WelcomeEnterpriseSmall BusinessHome & Home OfficePartnersAbout Symantec
SYM06-006
March 27, 2006
Veritas NetBackup: Multiple Overflow Vulnerabilities in NetBackup Daemons

Revision History
None

Risk Impact
High (very configuration-dependent)

NOTE: In recommended installations, Veritas NetBackup systems should always be restricted to trusted-host access. The Veritas NetBackup Server and clients should never be exposed external to the network. While the servers and clients are still potentially susceptible to an insider-based attack, this greatly reduces the risk from unauthorized remote access through external, unauthenticated type of attacks.

Remote AccessYes
Local AccessNo
Authentication RequiredYes, if properly configured to authenticate connecting hosts and/or only accept connections from trusted/authorized hosts
Exploit publicly availableNo

Overview

Multiple buffer overflow vulnerabilities have been identified in daemons running on Veritas NetBackup Master, Media Servers and clients. An attacker, able to access a vulnerable Veritas NetBackup server or client and successfully exploit any of these issues, could potentially execute arbitrary code resulting in possible unauthorized, elevated privileged access to the targeted system.

Product(s) Affected

ProductVersionBuildPlatformSolution(s)
NetBackup Enterprise Server/NetBackup Server; Server and Clients6.0AllAll6.0_MP2
NetBackup Enterprise Server/NetBackup Server; Server and Clients5.1AllAll5.1_MP4_S01, 5.1_MP5
NetBackup Enterprise Server/NetBackup Server; Server and Clients5.0AllAll5.0_MP6_S01, 5.0_MP7
NetBackup DataCenter and BusinesServer; Server and Clients4.5FPAllAll4.5_FP9-S2
NetBackup DataCenter and BusinesServer; Server and Clients4.5MPAllAll4.5_MP9_S2

NOTE: ONLY the products and versions listed above are affected by these issues.

Product versions prior to those listed above are NOT supported. Customers running legacy product versions should upgrade and apply updates.

Details
TippingPoint, a division of 3Com, notified Symantec of multiple buffer overflow vulnerabilities identified in daemons running on Veritas NetBackup. The daemons identified were the volume manager (vmd) daemon and the NetBackup Catalog (bpdbm) daemon found on all supported NetBackup product versions and platforms and the NetBackup Sharepoint Services server (bpspsserver) daemon installed only with NetBackup 6.0 for Windows.

The overflows occur due to a failure to do proper input validation of incoming data. A remote attacker who successfully gains network access to an affected system and successfully passes a specifically crafted packet through one of the supported protocol vectors to these vulnerable daemons could potentially execute arbitrary code with elevated privileges on the targeted system.

Symantec Response
Symantec engineers have addressed these issues in all currently supported versions of NetBackup. Symantec engineers did additional reviews and will continue on-going reviews of related file functionality to further enhance the overall security of Veritas NetBackup products and to eliminate any additional potential concerns.

Security updates are available for all supported products. Symantec strongly recommends all customers immediately apply the latest cumulative Security Pack updates or Maintenance Pack releases as indicated for their supported product versions to protect against threats of this nature.

NOTE: Security Packs (SPs) contain cumulative security fixes only. The Maintenance Packs (MPs and FPs) contain cumulative security fixes as well as additional product enhancements and technical updates.

Symantec knows of no exploitation of or adverse customer impact from these issues.

The patches listed above for affected products are available from the following location:
http://support.veritas.com/docs/281521

Best Practices
Implement NetBackup Access Control (NBAC) on NetBackup Servers and Clients
NBAC provides host-based authentication and user-level authorization through Veritas Security Services (VxSS) at both the server and the client to ensure communications are with a trusted host.

Disable/remove service for Microsoft Sharepoint Servers if not required
The bpspsserver daemon enabled by default on both servers and clients in the NetBackup 6.0 release, is used to support Microsoft SharePoint Servers on a network.
If not required, disabling this service can be done by removing the service entirely or by deleting the config file found at
\VERITAS\NetBackup\var\vnetd\inetd_bpspsserver.txt.

Implement Trusted-Host access through configuration files
Daemons associated with Veritas NetBackup services provide Trusted-Host access through the appropriate configuration files. Some of the services allow access by default while others deny access by default depending on the functionality of the service. Customers should follow the documentation provided for each service to ensure they have implemented a trusted-host relationship appropriate for their network.

The vmd, oprd and robotic daemons derive access control from the vm.conf file which allows access by default if there is no SERVER entry entered.

Using an appropriate text editor, configure vm.conf's "SERVER=<hostname>" for allowed host entries. Once a "SERVER=<hostname>" list is compiled, the associated daemons will ONLY trust and allow hosts annotated in vm.conf. Any malicious user or attacker would have to have either authorized access to or to gain access to one of the trusted-hosts to attempt attacks against a targeted server.

All other daemons associated with Veritas NetBackup derive access control from the NetBackup configuration which denies access by default.
Edit the configuration using "host properties" in the GUI to allow only those hosts that require access to associated NetBackup services. Any malicious user or attacker would have to have either authorized access to or gain access to one of the trusted-hosts to attempt attacks against a targeted server.

IPS/IDS Signatures
Symantec Security Response has released IPS/IDS signatures to detect and prevent attempts to exploit this issue.

Symantec ManHunt 3.0 signatures are available for update from the Symantec Security Response Update Center at:
http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_MH.html

Symantec Network Security Appliance 7100 signatures are available for update from the Symantec Security Response Update Center at:
http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_SNS.html

Symantec Gateway Security 3.0 signatures are available for update from the Symantec Security Response Update Center at:
http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_SGS.html

Symantec Client Security 2.0 and 3.0 signatures are available for update via LiveUpdate and from the Security Response Update Center at:
http://www.symantec.com/avcenter/security/Content/Product/Product_SCS.html

Customers using Symantec Client Security 2.0 and 3.0 should receive frequent signature updates if they run LiveUpdate regularly. If not, Symantec recommends customers manually run Symantec LiveUpdate to ensure they have the most current protection available.

Best Practices
As part of normal best practices, Symantec strongly recommends:

  • Restrict access to administration or management systems to privileged users.
  • Restrict remote access, if required, to trusted/authorized systems only.
  • Run under the principle of least privilege where possible to limit the impact of exploit by threats such as this.
  • Keep all operating systems and applications updated with the latest vendor patches.
  • Follow a multi-layered approach to security. Run both firewall and antivirus applications, at a minimum, to provide multiple points of detection and protection to both inbound and outbound threats.
  • Deploy network intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in detection of attacks or malicious activity related to exploitation of latent vulnerabilities

CVE
The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2006-0989 to the vmd overflow issue.
The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2006-0990 to the bpdbm overflow issue.
The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2006-0991 to the bpspsserver overflow issue.
These issues are candidates for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.

Credit
Symantec thanks 3Com for reporting these issues and for providing full coordination under responsible disclosure while Symantec resolved them.


Symantec takes the security and proper functionality of our products very seriously. As founding members of the Organization for Internet Safety (OISafety), Symantec supports and follows the principles of responsible disclosure. Symantec also subscribes to the vulnerability disclosure guidelines outlined by the National Infrastructure Advisory Council (NIAC).

Please contact secure@symantec.com if you feel you have discovered a security issue in a Symantec product. A Symantec Product Security team member will contact you regarding your submission. Symantec strongly recommends using encrypted email for reporting vulnerability information to secure@symantec.com. The Symantec Product Security PGP key can be found at the end of this message.

Symantec has developed a Product Vulnerability Response document outlining the process we follow in addressing suspected vulnerabilities in our products. This document is available below.

Symantec-Product-Vulnerability-Response Symantec Vulnerability Response Policy Symantec Product Vulnerability Management PGP Key Symantec Product Vulnerability Management PGP Key


Copyright (c) 2009 by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from secure@symantec.com.

Disclaimer
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

Symantec, Symantec products, Symantec Security Response, and secure@symantec.com are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.


Initial Post on: Monday, 27-Mar-06 11:10:00
Last modified on: Monday, 27-Mar-06 20:00:10