VERITAS Software Security Advisory VX05-002 and BackupExec 8.6

[Warren_Selby]

Is version 8.6 rev 3878 effected by this vulnerability?

[Chris_Jimenez]

I second this question, we still have about 30-40% of servers with v8.6

[Jan_Kristensen]

I would also like to see an answer to that question. But if 9.x and 10.x are affected, most likely the same flaws exist in 8.6. Don't you think?

Would be nice though to see a Veritas statement on this version.

[Brandon_Steili]

We went ahead and followed the steps outlined in the work around listed on this site anyway...

http://www.idefense.com/application/poi/display?id=272&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=269&type=vulnerabilities


Better safe than sorry....but I'm sure if you just HAD to know, you could quite easily find the code for the proof of concept and try it yourself...

[Ken_Putnam]

If you look at the bottom of http://seer.support.veritas.com/docs/276604.htm Veritas lists only v9 and v10 builds as vulnerable

[Brandon_Steili]

That's likely because it wasn't tested by Veritas. According to the group that made the find:

iDEFENSE has confirmed the existence of this vulnerability in Backup Exec for Windows Servers versions 9.1 and 10.0. It is suspected that earlier versions are also vulnerable.

8.x versions are fairly well out of date, so I don't blame them (Ver) for not testing it, but it still would be nice to know for sure. Either way, its better to know you're covered than to find out the hard way that just because they didn't explicitly say your version, didn't mean it wasn't going to hit you.

[Ork_Gandalf]

Perhaps versions 8.5 and 8.6 is not listed in Veritas document because these version are end-of-life. But I also wonder if they are vulnerable or not.

[ED_JONES]

so for version 8.6 I assume we can only block ports from the outside?

Ports 10000

and

Filter inbound TCP traffic on port 6106 to only trusted clients.

???????

[Bob_Emmons]

I did get a response from the company in the version 9.0 forum telling me how to upgrade to supported versions to apply the patch, (which we already knew) but still no definitive statement that the earlier versions are vulnerable.