Veritas System Recovery 16

CPE Details

Veritas System Recovery 16
veritas
system_recovery
16
2019-10-04
16h31 +00:00
2019-10-04
16h31 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:veritas:system_recovery:16:*:*:*:*:*:*:*

Informations

Vendor

veritas

Product

system_recovery

Version

16

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2020-36160 2021-01-05 23h53 +00:00 An issue was discovered in Veritas System Recovery before 21.2. On start-up, it loads the OpenSSL library from \usr\local\ssl. This library attempts to load the from \usr\local\ssl\openssl.cnf configuration file, which does not exist. By default, on Windows systems, users can create directories under C:\. A low privileged user can create a C:\usr\local\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data and installed applications, etc. If the system is also an Active Directory domain controller, then this can affect the entire domain.
9.3
Critical
CVE-2017-7444 2017-04-05 18h00 +00:00 In Veritas System Recovery before 16 SP1, there is a DLL hijacking vulnerability in the patch installer if an attacker has write access to the directory from which the product is executed.
7.8
High