CVE-2019-18780
📋 TL;DR
An unauthenticated remote attacker can execute arbitrary commands with root/administrator privileges on Veritas InfoScale Cluster Server components. This affects multiple Veritas products including Access, Flex Appliance, InfoScale, VCS, and SFHA across Linux/UNIX and Windows platforms.
💻 Affected Systems
- Veritas Access
- Veritas Access Appliance
- Veritas Flex Appliance
- Veritas InfoScale
- Veritas Cluster Server (VCS)
- Storage Foundation HA (SFHA)
📦 What is this software?
Access by Veritas
Infoscale by Veritas
Infoscale by Veritas
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root/administrator access, allowing data theft, ransomware deployment, or persistent backdoor installation across the entire cluster.
Likely Case
Remote code execution leading to data exfiltration, service disruption, or lateral movement within the network.
If Mitigated
Limited impact if systems are isolated behind firewalls with strict network segmentation and access controls.
🎯 Exploit Status
CVSS 9.8 indicates trivial exploitation with no authentication required. While no public PoC is confirmed, the high score suggests weaponization is likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply patches per vendor advisories: VTS19-003, VTS19-004, VTS19-005, VTS19-006
Vendor Advisory: https://www.veritas.com/content/support/en_US/security/VTS19-003
Restart Required: Yes
Instructions:
1. Review specific VTS advisory for your product. 2. Download appropriate patch from Veritas support portal. 3. Apply patch following vendor instructions. 4. Restart affected services/cluster components.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to Cluster Server ports (default 1850/tcp, 1851/tcp) using firewalls.
iptables -A INPUT -p tcp --dport 1850 -j DROP
iptables -A INPUT -p tcp --dport 1851 -j DROP
Windows Firewall Rule
windowsBlock Cluster Server ports on Windows systems.
New-NetFirewallRule -DisplayName "Block VCS Ports" -Direction Inbound -LocalPort 1850,1851 -Protocol TCP -Action Block
🧯 If You Can't Patch
- Isolate affected systems from internet and untrusted networks
- Implement strict network segmentation and monitor for suspicious connections to Cluster Server ports
🔍 How to Verify
Check if Vulnerable:
Check installed Veritas product version against affected versions list. Verify Cluster Server service is running.Check Version:
On UNIX/Linux: 'vxlicrep' or 'hastatus -sum'. On Windows: Check Programs and Features or Veritas management console.Verify Fix Applied:
Verify patch installation via vendor tools (e.g., 'vxlicrep' on UNIX/Linux) and confirm version is updated beyond vulnerable ranges.📡 Detection & Monitoring
Log Indicators:
- Unexpected process execution from Cluster Server components
- Authentication failures or unusual connections to port 1850/1851
- Commands with suspicious arguments in system logs
Network Indicators:
- Unusual outbound connections from Cluster Server hosts
- Exploit attempts to port 1850/1851
- Unexpected network traffic patterns from affected systems
SIEM Query:
source="*veritas*" OR dest_port=1850 OR dest_port=1851 AND (process_execution="*cmd*" OR process_execution="*sh*" OR process_execution="*powershell*")🔗 References
- https://www.veritas.com/content/support/en_US/security/VTS19-003
- https://www.veritas.com/content/support/en_US/security/VTS19-004
- https://www.veritas.com/content/support/en_US/security/VTS19-005
- https://www.veritas.com/content/support/en_US/security/VTS19-006
- https://www.veritas.com/content/support/en_US/security/VTS19-003
- https://www.veritas.com/content/support/en_US/security/VTS19-004
- https://www.veritas.com/content/support/en_US/security/VTS19-005
- https://www.veritas.com/content/support/en_US/security/VTS19-006
