Remote Code Execution via Malicious Backup Config in Tape Software

Executive Summary

This vulnerability in Veeam Backup & Replication allows a Backup or Tape Operator to execute remote code as the root user by creating a malicious backup configuration file. This means an attacker with Backup or Tape Operator privileges can gain full control over the system remotely by exploiting this flaw. [1]

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows remote code execution with root privileges, which can lead to unauthorized access, modification, or destruction of sensitive data. This poses a significant risk to the confidentiality, integrity, and availability of data, potentially resulting in non-compliance with data protection standards and regulations such as GDPR and HIPAA that require strict controls to protect sensitive information. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to remote code execution with root privileges, allowing an attacker to fully compromise the affected system. This can result in unauthorized access, data theft, data corruption, or disruption of backup services, severely impacting system confidentiality, integrity, and availability. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Users are strongly advised to update Veeam Backup & Replication to version 13.0.1.1071 or later, as this version resolves the vulnerability allowing remote code execution by a Backup or Tape Operator via a malicious backup configuration file. [1]

Useful 0 Not Useful 0