[ISN] Critical Veritas attack code loose

[InfoSec News]

http://www.techworld.com/security/news/index.cfm?NewsID=4215

By Robert McMillan
IDG News Service
15 August 2005

Attackers are exploiting an unpatched hole in Symantec's Veritas
Backup Exec Agent for Windows, the company has warned.

A flaw in the product's Network Data Management Protocol agent could
allow an attacker to gain access to the system and download files, the
Fr-SIRT (French Security Incident Response Team) said in a statement
Friday. Fr-SIRT rates the vulnerability as "critical".

Symantec, which acquired Veritas in July of this year, says it is "not
aware of any vendor-supplied patches for this issue". The company
recommends that users block access to the TCP port that uses the
service in question, port 10,000.

The Metasploit penetration testing toolkit already takes advantage of
this vulnerability, and there are reports that exploits for the flaw
are already being used by attackers, Symantec said.

The SANS Internet Storm Center said on its website on Friday that it
has seen a jump in scans for port 10,000, and it advises Backup Exec
users to block access to that port from all untrusted network.

The flaw affects versions 8.x, 9.0, 9.1, and 10.0 of Backup Exec for
Windows Servers, Fr-SIRT said.