CVE-2017-8895

Related Files

Veritas/Symantec Backup Exec SSL NDMP Connection Use-After-Free

Posted Jun 29, 2017

Authored by Matthew Daley | Site metasploit.com

This Metasploit module exploits a use-after-free vulnerability in the handling of SSL NDMP connections in Veritas/Symantec Backup Exec's Remote Agent for Windows. When SSL is re-established on a NDMP connection that previously has had SSL established, the BIO struct for the connection's previous SSL session is reused, even though it has previously been freed. This Metasploit module supports 3 specific versions of the Backup Exec agent in the 14, 15 and 16 series on 64-bit and 32-bit versions of Windows and has been tested from Vista to Windows 10.

tags | exploit, remote

systems | windows

advisories | CVE-2017-8895

SHA-256 | 18615ac29398d7f2d7f4f16eff1790cc387a69c2808a4e6bb7a5632253c7e45f

Download | Favorite | View

Veritas Backup Exec Remote Agent For Windows Use-After-Free

Posted May 27, 2017

Authored by Matthew Daley

Veritas Backup Exec Remote Agent for Windows suffers from a use-after-free vulnerability. All versions before Backup Exec 16 FP1, Backup Exec 15 14.2.1180.3160, and Backup Exec 2014 14.1.1187.1126 are affected.

tags | advisory, remote

systems | windows

advisories | CVE-2017-8895

SHA-256 | 8ceb02397eea9ab98abf9619f4ab71f85b7ac2f8ffa9d669f5e674239b69ebd6

Download | Favorite | View