CVE-2024-35204: 
Veritas System Recovery vulnerability analysis and mitigation

Veritas System Recovery versions prior to 23.3_Hotfix contain a high-severity vulnerability (CVE-2024-35204) related to incorrect permissions for the Veritas System Recovery folder. The vulnerability was discovered and disclosed on May 14, 2024, affecting multiple versions including 23.3, 23.2, 23.1, 23.0, 22.0, 21.3, 21.2, 21.1, and 21.0, as well as potentially earlier unsupported versions (Veritas Advisory).

The vulnerability stems from the way Veritas System Recovery service handles logging information. When running, the service logs information into 'C:\ProgramData\Veritas\VERITAS SYSTEM RECOVERY\LOGS\Veritas System Recovery.log.txt' file with NT Authority\System permissions. The file is not exclusively opened or protected, allowing it to be deleted at any time. Additionally, the LOGS directory is modifiable by low-privileged Windows system users, enabling transformation into a directory junction and symbolic link. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-272: Least Privilege Violation (Veritas Advisory).

The vulnerability allows attackers with low-privilege Windows system user access to create files in arbitrary locations within the filesystem, including protected directories such as C:\Windows, C:\Windows\System32, and C:\Program Files. This capability could be exploited to cause denial of service or tamper with important services, such as backup services, using a low-privilege user account (Security Online).

The vulnerability can be exploited by low-privileged users who have access to the system. The attack vector is local (AV:L), requiring low attack complexity (AC:L) with no privileges required (PR:N) and no user interaction (UI:N) (Veritas Advisory).

Veritas has released Hotfix 860045 to address the vulnerability. Customers under a current maintenance contract who are running in low privilege user mode should download and execute the script available from the Veritas Download Center under the Updates section. The fix is included in version 23.3_Hotfix (Veritas Advisory).