Use After Free in Veritas Backup Exec
CVE-2017-8895
In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution. An unauthenticated attacker can use this vulnerability to crash the agent or potentially take control of the agent process and then the system it is running on.
Vulnerability class: Use-After-Free
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.710 (99.4th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.710 · newest: 0.710 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securityfocus.com/bid/98386 (VDB Entry, Third Party Advisory, vdb-entry)
- www.veritas.com/content/support/en_US/security/VTS17-006.html (Patch, Vendor Advisory)
- www.securitytracker.com/id/1038561 (VDB Entry, Third Party Advisory, vdb-entry)
- www.exploit-db.com/exploits/42282/ (VDB Entry, Third Party Advisory, exploit)
Frequently asked questions
- What is CVE-2017-8895?
- CVE-2017-8895 is a critical-severity vulnerability in Veritas Backup Exec, classified under Use After Free. CVSS score: 9.8/10. Published 2017-05-10.
- How severe is CVE-2017-8895?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2017-8895 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.