CVE-2020-36164
📋 TL;DR
This vulnerability allows low-privileged users to achieve arbitrary code execution as SYSTEM by planting a malicious OpenSSL configuration file. It affects Veritas Enterprise Vault servers with specific components like SMTP Server, IMAP Server, or File System Archiving. Attackers gain full administrator access to compromised systems.
💻 Affected Systems
- Veritas Enterprise Vault
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing data theft, application access, and lateral movement within the network.
Likely Case
Privilege escalation from low-privileged user to SYSTEM, leading to full control of the affected server.
If Mitigated
Limited impact if proper file permissions prevent directory creation in system locations.
🎯 Exploit Status
Requires low-privileged user access to create directories and files in system locations. Exploitation is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 14.0 with patch or later versions
Vendor Advisory: https://www.veritas.com/content/support/en_US/security/VTS20-013
Restart Required: Yes
Instructions:
1. Download the patch from Veritas support portal. 2. Apply the patch to affected Enterprise Vault servers. 3. Restart the Enterprise Vault services.
🔧 Temporary Workarounds
Restrict directory creation permissions
windowsPrevent low-privileged users from creating directories in C:\ and installation drive root paths
icacls C:\ /deny Everyone:(OI)(CI)(WD,AD)
Create dummy openssl.cnf files
windowsCreate read-only openssl.cnf files in vulnerable locations to prevent malicious file creation
echo # Safe config > C:\Isode\etc\ssl\openssl.cnf
icacls C:\Isode\etc\ssl\openssl.cnf /deny Everyone:(W)
🧯 If You Can't Patch
- Implement strict file system permissions to prevent low-privileged users from creating directories in C:\ and installation drive roots
- Monitor for directory creation attempts in vulnerable paths and investigate any unauthorized file creation
🔍 How to Verify
Check if Vulnerable:
Check if Enterprise Vault version is 14.0 or earlier and has vulnerable components installed. Verify if low-privileged users can create directories in C:\ and installation drive roots.Check Version:
Check Enterprise Vault version in administration console or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Veritas\Enterprise Vault\VersionVerify Fix Applied:
Verify patch installation through Enterprise Vault administration console and confirm directory permissions prevent low-privileged users from creating files in vulnerable paths.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing directory creation in C:\Isode\etc\ssl\ or similar paths
- Enterprise Vault service restart events following suspicious file creation
Network Indicators:
- Unusual outbound connections from Enterprise Vault servers following service restarts
SIEM Query:
EventID=4663 AND ObjectName LIKE '%openssl.cnf%' OR EventID=4688 AND NewProcessName LIKE '%openssl%'