CVE-2020-36160: 
Veritas System Recovery vulnerability analysis and mitigation

CVE-2020-36160 is a critical vulnerability discovered in Veritas System Recovery (VSR) affecting versions prior to 21.2. The vulnerability was disclosed on January 5, 2021. The issue affects Windows versions of VSR including 21.1, 21, 18.0.4, 18.0.3, 18.0.2, 18.0.1, 18.0, 16.0.2, 16.0.1 and 16, while non-Windows platforms are not affected (Vendor Advisory).

The vulnerability occurs when VSR loads the OpenSSL library from \usr\local\ssl on startup. The library attempts to load a configuration file from \usr\local\ssl\openssl.cnf, which does not exist by default. Since Windows systems allow users to create directories under C:, a low-privileged user can create a malicious OpenSSL configuration file at C:\usr\local\ssl\openssl.cnf. The vulnerability has been assigned a CVSS v3.1 Base Score of 9.3 (CRITICAL) with vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (Vendor Advisory).

When successfully exploited, this vulnerability allows attackers to execute arbitrary code with SYSTEM privileges when the service starts. This grants the attacker administrator access to the system, enabling access to all data and installed applications. If the compromised system is an Active Directory domain controller, the impact extends to the entire domain (Vendor Advisory).

The vulnerability can be exploited by a low-privileged user on the Windows system without requiring any privileges in VSR. The attack involves creating a malicious OpenSSL configuration file in a specific location that gets loaded during service startup (Vendor Advisory).

The primary remediation is to upgrade to Veritas System Recovery (VSR) 21.2 or later. For customers unable to upgrade immediately, a workaround exists: use an administrator account to create the directory '\usr\local\ssl' under the root of all drives and set the ACL on the directory to deny write access to all other users. This prevents attackers from installing a malicious OpenSSL engine (Vendor Advisory).