__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
kernel-source-2.6.8
[SYM06-006]
March 28, 2006 18:00 GMT Number Q-156
______________________________________________________________________________
PROBLEM: Veritas NetBackup overflow vulnerabilities in vmd, bpdbm and
bpspsserver.
PLATFORM: NetBackup Enterprise Server/NetBackup Server; Server and
Clients 6.0, 5.1, 5.0. NetBackup DataCenter and BusinesServer;
Server and Clients 4.5MP, 4.5FP
DAMAGE: Daemons could let remote users execute arbitrary code.
SOLUTION: Apply current patches
______________________________________________________________________________
VULNERABILITY The risk is HIGH. Daemons could let remote users execute
ASSESSMENT: arbitrary code.
______________________________________________________________________________
LINKS:
CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/q-156.shtml
ORIGINAL BULLETIN: http://securityresponse.symantec.com/avcenter/security/
Content/2006.03.27.html
CVE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=
CVE-2006-0989, CVE-2006-0990, CVE-2006-0991
______________________________________________________________________________
[***** Start SYM06-006 *****]
SYM06-006
March 27, 2006
Veritas NetBackup: Multiple Overflow Vulnerabilities in NetBackup Daemons
Revision History
None
Risk Impact
High (very configuration-dependent)
NOTE: In recommended installations, Veritas NetBackup systems should always be restricted to trusted-host access. The Veritas NetBackup Server and clients should never be exposed external to the network. While the servers and clients are still potentially susceptible to an insider-based attack, this greatly reduces the risk from unauthorized remote access through external, unauthenticated type of attacks.
Remote Access Yes
Local Access No
Authentication Required Yes, if properly configured to authenticate connecting hosts and/or only accept connections from trusted/authorized hosts
Exploit publicly available No
Overview
Multiple buffer overflow vulnerabilities have been identified in daemons running on Veritas NetBackup Master, Media Servers and clients. An attacker, able to access a vulnerable Veritas NetBackup server or client and successfully exploit any of these issues, could potentially execute arbitrary code resulting in possible unauthorized, elevated privileged access to the targeted system.
Product(s) Affected
Product Version Build Platform Solution(s)
NetBackup Enterprise Server/NetBackup Server; Server and Clients 6.0 All All 6.0_MP2
NetBackup Enterprise Server/NetBackup Server; Server and Clients 5.1 All All 5.1_MP4_S01, 5.1_MP5
NetBackup Enterprise Server/NetBackup Server; Server and Clients 5.0 All All 5.0_MP6_S01, 5.0_MP7
NetBackup DataCenter and BusinesServer; Server and Clients 4.5FP All All 4.5_FP9-S2
NetBackup DataCenter and BusinesServer; Server and Clients 4.5MP All All 4.5_MP9_S2
NOTE: ONLY the products and versions listed above are affected by these issues.
Product versions prior to those listed above are NOT supported. Customers running legacy product versions should upgrade and apply updates.
Details
TippingPoint, a division of 3Com, notified Symantec of multiple buffer overflow vulnerabilities identified in daemons running on Veritas NetBackup. The daemons identified were the volume manager (vmd) daemon and the NetBackup Catalog (bpdbm) daemon found on all supported NetBackup product versions and platforms and the NetBackup Sharepoint Services server (bpspsserver) daemon installed only with NetBackup 6.0 for Windows.
The overflows occur due to a failure to do proper input validation of incoming data. A remote attacker who successfully gains network access to an affected system and successfully passes a specifically crafted packet through one of the supported protocol vectors to these vulnerable daemons could potentially execute arbitrary code with elevated privileges on the targeted system.
Symantec Response
Symantec engineers have addressed these issues in all currently supported versions of NetBackup. Symantec engineers did additional reviews and will continue on-going reviews of related file functionality to further enhance the overall security of Veritas NetBackup products and to eliminate any additional potential concerns.
Security updates are available for all supported products. Symantec strongly recommends all customers immediately apply the latest cumulative Security Pack updates or Maintenance Pack releases as indicated for their supported product versions to protect against threats of this nature.
NOTE: Security Packs (SPs) contain cumulative security fixes only. The Maintenance Packs (MPs and FPs) contain cumulative security fixes as well as additional product enhancements and technical updates.
Symantec knows of no exploitation of or adverse customer impact from these issues.
The patches listed above for affected products are available from the following location:
http://support.veritas.com/docs/281521
Best Practices
Implement NetBackup Access Control (NBAC) on NetBackup Servers and Clients
NBAC provides host-based authentication and user-level authorization through Veritas Security Services (VxSS) at both the server and the client to ensure communications are with a trusted host.
Disable/remove service for Microsoft Sharepoint Servers if not required
The bpspsserver daemon enabled by default on both servers and clients in the NetBackup 6.0 release, is used to support Microsoft SharePoint Servers on a network.
If not required, disabling this service can be done by removing the service entirely or by deleting the config file found at
\VERITAS\NetBackup\var\vnetd\inetd_bpspsserver.txt.
Implement Trusted-Host access through configuration files
Daemons associated with Veritas NetBackup services provide Trusted-Host access through the appropriate configuration files. Some of the services allow access by default while others deny access by default depending on the functionality of the service. Customers should follow the documentation provided for each service to ensure they have implemented a trusted-host relationship appropriate for their network.
The vmd, oprd and robotic daemons derive access control from the vm.conf file which allows access by default if there is no SERVER entry entered.
Using an appropriate text editor, configure vm.conf's "SERVER=<hostname>" for allowed host entries. Once a "SERVER=<hostname>" list is compiled, the associated daemons will ONLY trust and allow hosts annotated in vm.conf. Any malicious user or attacker would have to have either authorized access to or to gain access to one of the trusted-hosts to attempt attacks against a targeted server.
All other daemons associated with Veritas NetBackup derive access control from the NetBackup configuration which denies access by default.
Edit the configuration using "host properties" in the GUI to allow only those hosts that require access to associated NetBackup services. Any malicious user or attacker would have to have either authorized access to or gain access to one of the trusted-hosts to attempt attacks against a targeted server.
IPS/IDS Signatures
Symantec Security Response has released IPS/IDS signatures to detect and prevent attempts to exploit this issue.
Symantec ManHunt 3.0 signatures are available for update from the Symantec Security Response Update Center at:
http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_MH.html
Symantec Network Security Appliance 7100 signatures are available for update from the Symantec Security Response Update Center at:
http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_SNS.html
Symantec Gateway Security 3.0 signatures are available for update from the Symantec Security Response Update Center at:
http://securityresponse.symantec.com/avcenter/security/Content/Product/Product_SGS.html
Symantec Client Security 2.0 and 3.0 signatures are available for update via LiveUpdate and from the Security Response Update Center at:
http://www.symantec.com/avcenter/security/Content/Product/Product_SCS.html
Customers using Symantec Client Security 2.0 and 3.0 should receive frequent signature updates if they run LiveUpdate regularly. If not, Symantec recommends customers manually run Symantec LiveUpdate to ensure they have the most current protection available.
Best Practices
As part of normal best practices, Symantec strongly recommends:
Restrict access to administration or management systems to privileged users.
Restrict remote access, if required, to trusted/authorized systems only.
Run under the principle of least privilege where possible to limit the impact of exploit by threats such as this.
Keep all operating systems and applications updated with the latest vendor patches.
Follow a multi-layered approach to security. Run both firewall and antivirus applications, at a minimum, to provide multiple points of detection and protection to both inbound and outbound threats.
Deploy network intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in detection of attacks or malicious activity related to exploitation of latent vulnerabilities
CVE
The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2006-0989 to the vmd overflow issue.
The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2006-0990 to the bpdbm overflow issue.
The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate CVE-2006-0991 to the bpspsserver overflow issue.
These issues are candidates for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
Credit
Symantec thanks 3Com for reporting these issues and for providing full coordination under responsible disclosure while Symantec resolved them.
--------------------------------------------------------------------------------
Symantec takes the security and proper functionality of its products very seriously. As founding members of the Organization for Internet Safety (OISafety), Symantec follows the principles of responsible disclosure. Symantec also subscribes to the vulnerability guidelines outlined by the National Infrastructure Advisory Council (NIAC). Please contact secure@symantec.com if you feel you have discovered a potential or actual security issue with a Symantec product. A Symantec Product Security team member will contact you regarding your submission.
Symantec has developed a Product Vulnerability Handling Process document outlining the process we follow in addressing suspected vulnerabilities in our products. We support responsible disclosure of all vulnerability information in a timely manner to protect Symantec customers and the security of the Internet as a result of vulnerability. This document is available from the location provided below.
Symantec strongly recommends using encrypted email for reporting vulnerability information to secure@symantec.com. The Symantec Product Security PGP key can be obtained from the location provided below.
Symantec Vulnerability Response Policy Symantec Product Vulnerability Management PGP Key
--------------------------------------------------------------------------------
Copyright (c) 2006 by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from secure@symantec.com.
Disclaimer
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
Symantec, Symantec products, Symantec Security Response, and SymSecurity are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.
Initial Post on: Monday, 27-Mar-06 11:10:00
Last modified on: Monday, 27-Mar-06 12:00:10
[***** End SYM06-006 *****]
_______________________________________________________________________________
CIAC wishes to acknowledge the contributions of Symantec for the
information contained in this bulletin.
_______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7x24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
Q-146: Permissive Windows Services DACLs
Q-147: Macromedia Flash Player Update to Address Security Vulnerabilities
Q-148: Media Server BENGINE Service Job Log Format String Overflow
Q-150: unzip
Q-149: kernel-patch-vserver, util-vserver
Q-151: sendmail Security Update
Q-152: snmptrapfmt
Q-153: RealPlayer Security Update
Q-154: Vulnerability in the way HTML Objects Handle Unexpected Method Calls
Q-155: kernel-source-2.6.8