Veritas System Recovery (VSR) 21.1

CPE Details

Veritas System Recovery (VSR) 21.1
veritas
system_recovery
21.1
2021-01-08
14h03 +00:00
2021-01-08
14h03 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:veritas:system_recovery:21.1:*:*:*:*:*:*:*

Informations

Vendor

veritas

Product

system_recovery

Version

21.1

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2020-36160 2021-01-05 23h53 +00:00 An issue was discovered in Veritas System Recovery before 21.2. On start-up, it loads the OpenSSL library from \usr\local\ssl. This library attempts to load the from \usr\local\ssl\openssl.cnf configuration file, which does not exist. By default, on Windows systems, users can create directories under C:\. A low privileged user can create a C:\usr\local\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data and installed applications, etc. If the system is also an Active Directory domain controller, then this can affect the entire domain.
9.3
Critical