The U.S. governments computer watchdog group issued a warning Thursday about possible attacks on systems running computer backup software from Veritas.
The U.S. Computer Emergency Readiness Team (CERT) said that systems running Veritas Backup Exec Agent software are being actively exploited on the Internet through a publicly available exploit code that compromises a recently disclosed buffer overflow vulnerability.
Backup Exec Remote Agent is a widely distributed software program in organizations that use Veritas software. It runs on all systems that have data that will be backed up, and listens on TCP (Transmission Control Protocol) port 10000 for instructions to begin backing up data.
/zimages/1/28571.gifVeritas patches system access and denial-of-service vulnerabilities in Veritas Backup Exec for Windows and NetWare servers.Click hereto read more.
However, the agent contains a buffer overflow vulnerability that could allow a remote attacker to use a specially formatted authentication request to run his own code on systems that have the agent installed, allowing the attacker to execute arbitrary code, according to U.S. CERT.
The vulnerability was first disclosed on June 22. By June 28, the SANS Institutes Internet Storm Center had received reports about a new remote control, or “bot,” software variant that scanned the Internet for machines that listened on TCP port 10000 and tried to exploit the new Veritas vulnerability.
CERT said that it has also received credible reports of attempts to use the Veritas vulnerability to compromise systems on the Internet.
CERT recommended that companies running the Backup Exec Remote Agent should apply patches issued by Veritas and restrict access to vulnerable machines using firewall and traffic filtering software.
CERT is also investigating two other serious vulnerabilities in Backup Exec, according to a statement.
/zimages/1/28571.gifCheck out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.