CVE-2020-36167: 
Veritas Backup Exec Agent vulnerability analysis and mitigation

A critical vulnerability (CVE-2020-36167) was discovered in Veritas Backup Exec through versions 16.2, 20.6 (before hotfix 298543), and 21.1 (before hotfix 657517). The vulnerability was discovered and disclosed in December 2020, affecting the Backup Exec server component. The issue stems from the server's OpenSSL library loading mechanism, which attempts to load a configuration file from a predictable location that may not exist (CERT Advisory, Veritas Advisory).

The vulnerability occurs when the Backup Exec service loads the OpenSSL library from its installation folder during startup. The library attempts to load the /usr/local/ssl/openssl.cnf configuration file, which on Windows systems translates to :\usr\local\ssl\openssl.cnf. The CVSS v3.1 Base Score is 8.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating the severity of the vulnerability. The issue specifically affects only Backup Exec servers and not the agents (NVD, Veritas Advisory).

The vulnerability allows a low-privileged user to gain administrator access to the system by creating a malicious OpenSSL configuration file. This access enables the attacker to access all data, installed applications, and system resources. If the affected system is an Active Directory domain controller, the impact extends to the entire domain. The execution occurs with SYSTEM privileges when the service starts (Veritas Advisory).

The vulnerability can be exploited by a low-privileged local user without any privileges in Backup Exec. The attacker needs to create a :\usr\local\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine. The exploitation occurs when the service starts, requiring no user interaction (CERT Advisory, Veritas Advisory).

Veritas released patches to address this vulnerability: Backup Exec 21.1 Hotfix 657517 (Engineering version 21.0.1200.1217) for BE 21.x users, and Backup Exec 20.6 Hotfix 298543 (Engineering version 20.0.1188.2734) for BE 20.x users. For version 16.x or older, upgrading to Backup Exec 21.1 + patch is recommended. As a workaround, administrators can create the '\usr\local\ssl' directory under the root of all drives and set ACLs to deny write access to all other users (Veritas Advisory).