From: "Geo" 

"John Cuccia"  wrote in message
news:i79bs09887gba79c4bpkaq7ctm5dhkov4k{at}4ax.com...

> >The last thing I want is a backup program that installs it's own web
server
> >and allows all kinds of remote access to it. So I guess my big question
> >about current versions of BE are what does it install that makes it so
big?
>
> It uses MSDE.

It also requires agents on all remote machines (I hate agents). People
wonder why I hate this obnoxious stuff, well below is one really good
reason that oddly enough came across my email today.

Geo.

The following security advisory is sent to the securiteam mailing list, and
can be found at the SecuriTeam web site: http://www.securiteam.com

  Veritas Backup Exec Agent Browser Registration Request Buffer Overflow
------------------------------------------------------------------------


SUMMARY

 http://veritas.com/Products/www?c=product&refId=57> Backup Exec is a
next generation backup and restore solution for Microsoft Windows server
environments.

Remote exploitation of a stack-based buffer overflow vulnerability in
Veritas Backup Exec allows attackers to execute arbitrary code.

DETAILS

Vulnerable Systems:
 * Veritas Backup Exec Agent version 9.1 for Windows

Immune Systems:
 * Veritas Backup Exec Agent version 9.1.4691 Hotfix 40

CVE Information:
 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1172>
CAN-2004-1172 - Browser Registration Request Buffer Overflow

The vulnerability exists within the function responsible for receiving and
parsing registration requests. The registration request packet contains the
hostname and connecting TCP port of the client which is stored in an array
on the stack. An attacker can send a registration request with an overly
long hostname value to overflow the array and take control of the saved
return address, thereby executing arbitrary code.

Impact
Successful exploitation does not require authentication thereby allowing
any remote attacker to execute arbitrary code under the privileges of the
Backup Exec Agent Browser (benetns.exe) process which is usually a domain
administrative account.

Workaround
Use a firewall to restrict incoming connections to trusted workstations
running the Backup Exec client software.

Vendor Status:
The vendor has released a hotfix that addresses this vulnerability.

8.60.3878 Hotfix 68 - Backup Exec (Buffer overflow creates a security hole
in Agent Browser):
 http://seer.support.veritas.com/docs/273422.htm>
http://seer.support.veritas.com/docs/273422.htm

9.1.4691 Hotfix 40 - Backup Exec (Buffer overflow creates a security hole
in Agent Browser; Licensed Storage Central becomes Eval when Backup Exec
9.1 is uninstalled)
 http://seer.support.veritas.com/docs/273420.htm>
http://seer.support.veritas.com/docs/273420.htm

Note: Requires Backup Exec 9.1.4691 Service Pack 1.

Disclosure Timeline:
11/02/2004 - Initial vendor contact 12/16/2004 - Initial vendor response
12/16/2004 - Public disclosure


ADDITIONAL INFORMATION

The information has been provided by
 iDEFENSE Security Labs.
The original article can be found at:
http://www.idefense.com/application/poi/display?id=169>
http://www.idefense.com/application/poi/display?id=169



========================================


This bulletin is sent to members of the SecuriTeam mailing list. To
unsubscribe from the list, send mail with an empty subject line and body
to: list-unsubscribe{at}securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe{at}securiteam.com


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without
warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.

--- BBBS/NT v4.01 Flag-5