Veritas Backup Exec for Windows Servers contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote user sends a CONNECT_CLIENT_AUTH request with a hardcoded password value to trigger the flaw. If successful, the flaw will disclose arbitrary files that are accessible via the Windows system account, resulting in a loss of confidentiality.

Currently, there are no known upgrades or patches to correct this issue for the Backup Exec Windows Server 8.6 version.

For all effected versions, it is possible to correct the flaw by implementing the following workaround(s):

Block external access to the service (TCP port 10000) at the network perimeter

For Backup Exec for Windows Servers 9.0, 9.1, & 10.0, Backup Exec for Netware Servers 9.1, and Netbackup for Netware Media Servers Option 4.5, 4.5 FP, 5.0, & 5.1, Veritas has released a patch to address this vulnerability.

• Security Tracker: 1014662
• Milw0rm: 1147
• Exploit Database: 1147
• Bugtraq ID: 14551
• Secunia Advisory ID: 16403
• SCIP VulDB ID: 1699
• Metasploit ID: 18695
• CVE ID: 2005-2611 (see also: NVD)
• ISS X-Force ID: 21793
• CERT VU: 378957
• VUPEN Advisory: ADV-2005-1387
• Vendor Specific Advisory URL: http://securityresponse.symantec.com/avcenter/security/Content/2005.08.12b.html
  http://seer.support.veritas.com/docs/255831.htm
• Other Advisory URL: http://www.auscert.org.au/render.html?it=5383
  http://www.us-cert.gov/cas/techalerts/TA05-224A.html
• Generic Exploit URL: http://www.frsirt.com/exploits/20050811.backupexec_dump.pm.php
  http://www.metasploit.com/projects/Framework/exploits.html#backupexec_dump
• Generic Informational URL: http://www.techworld.com/security/news/index.cfm?NewsID=4215
• CERT: TA05-224A

Unknown or Incomplete