Use After Free in Veritas Backup Exec
CVE-2017-8895
In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution. An unauthenticated attacker can use this vulnerability to crash the agent or potentially take control of the agent process and then the system it is running on.
Vulnerability class: Use-After-Free
EPSS: 0.710 (99.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Veritas Backup_exec
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)
Frequently asked questions
- What is CVE-2017-8895?
- CVE-2017-8895 is a critical-severity vulnerability in Veritas Backup Exec, classified under Use After Free. CVSS score: 9.8/10. Published 2017-05-10.
- How severe is CVE-2017-8895?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2017-8895 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.