Revision History

  • 1.0: December 23, 2020: Initial version
  • 1.1:January 8, 2021: Added CVE ID, link to Download Center
  • 1.2: February 17, 2021: Added Mitigation section

Summary

As part of our ongoing testing process Veritas has discovered an issue where Veritas Desktop and Laptop Option (DLO) could allow an attacker to run arbitrary code with administrator privilege.

Issue

CVE ID: CVE-2020-36165
Severity: Critical
CVSS v3.1 Base Score: 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

On start-up, the Veritas Desktop and Laptop Option (DLO) loads the OpenSSL library from /ReleaseX64/ssl. This library attempts to load the /ReleaseX64/ssl/openssl.cnf configuration file which does not exist. By default, on Windows systems, users can create directories under C:\. A low privileged user on the Windows system without any privileges in DLO can create a C:/ReleaseX64/ssl/openssl.cnf configuration file to load a malicious OpenSSL engine resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, to access all installed applications, etc.

This vulnerability impacts the DLO server and client installations.

Affected Versions

Veritas Desktop and Laptop Option (DLO) versions 9.3.3, 9.3.2, 9.3.1, 9.3, 9.2, 9.1, 9.0.1, and 9.0. Earlier unsupported versions may be affected as well.

Remediation

Customers under a current maintenance contract can download and install Veritas Desktop and Laptop Option version 9.5 to fix the vulnerability.

Mitigation

If not applying a recommended remediation listed above, use an administrator account to create the directory ‘\usr\local\ssl’ under root of all drives and set the ACL on the directory to deny write access to all other users. This will prevent an attacker from installing a malicious OpenSSL engine.

See the Veritas Download Center for available updates: https://www.veritas.com/support/en_US/downloads

Questions

For questions or problems regarding these vulnerabilities please contact Veritas Technical Support (https://www.veritas.com/support).