CVE-2018-1161
📋 TL;DR
This is a critical remote code execution vulnerability in Quest NetVault Backup that allows unauthenticated attackers to execute arbitrary code with SYSTEM privileges. The vulnerability exists in the nvwsworker.exe component when processing multipart request boundary headers. All systems running vulnerable versions of NetVault Backup are affected.
💻 Affected Systems
- Quest NetVault Backup
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing attackers to install malware, steal data, pivot to other systems, or establish persistent access.
Likely Case
Remote code execution leading to ransomware deployment, data exfiltration, or installation of backdoors for future attacks.
If Mitigated
Limited impact if proper network segmentation, firewalls, and intrusion detection systems are in place to block exploitation attempts.
🎯 Exploit Status
The vulnerability is in a network service and requires no authentication, making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.3.0.12 or later
Vendor Advisory: https://support.quest.com/netvault-backup/kb/311640/quest-netvault-backup-security-vulnerabilities-november-2018
Restart Required: Yes
Instructions:
1. Download the latest NetVault Backup version from Quest support portal. 2. Backup current configuration. 3. Stop NetVault Backup services. 4. Install the update. 5. Restart services and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to NetVault Backup servers using firewalls or network ACLs
Service Hardening
windowsRun NetVault Backup services with reduced privileges instead of SYSTEM
sc config "NetVault Backup Service" obj= "NT AUTHORITY\LocalService"
🧯 If You Can't Patch
- Implement strict network access controls to limit connections to NetVault Backup servers
- Deploy intrusion detection/prevention systems to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check NetVault Backup version in the administration console or by examining installed programs in Control PanelCheck Version:
wmic product where "name like '%NetVault%'" get versionVerify Fix Applied:
Verify version is 11.3.0.12 or later and test multipart request handling functionality📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from nvwsworker.exe
- Multiple failed multipart requests
- Unexpected network connections from NetVault Backup server
Network Indicators:
- Unusual traffic to NetVault Backup ports (typically 20031-20034)
- Malformed multipart requests with long boundary headers
SIEM Query:
source="netvault.log" AND ("buffer overflow" OR "nvwsworker.exe" AND "crash")