Revision History

  • 1.0: December 23, 2020: Initial version
  • 1.1:January 8, 2021: Added CVE ID, link to Download Center

Summary

As part of our ongoing testing process Veritas has discovered an issue where Veritas Desktop and Laptop Option (DLO) could allow an attacker to run arbitrary code with administrator privilege.

Issue

CVE ID: CVE-2020-36165
Severity: Critical
CVSS v3.1 Base Score: 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

On start-up, the Veritas Desktop and Laptop Option (DLO) loads the OpenSSL library from /ReleaseX64/ssl. This library attempts to load the /ReleaseX64/ssl/openssl.cnf configuration file which does not exist. By default, on Windows systems, users can create directories under C:\. A low privileged user on the Windows system without any privileges in DLO can create a C:/ReleaseX64/ssl/openssl.cnf configuration file to load a malicious OpenSSL engine resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, to access all installed applications, etc.

This vulnerability impacts the DLO server and client installations.

Affected Versions

Veritas Desktop and Laptop Option (DLO) versions 9.3.3, 9.3.2, 9.3.1, 9.3, 9.2, 9.1, 9.0.1, and 9.0. Earlier unsupported versions may be affected as well.

Remediation

Customers under a current maintenance contract can download and install Veritas Desktop and Laptop Option version 9.5 to fix the vulnerability.

See the Veritas Download Center for available updates: https://www.veritas.com/support/en_US/downloads

Questions

For questions or problems regarding these vulnerabilities please contact Veritas Technical Support (https://www.veritas.com/support).