« Volver al listado

CVE-2020-36166

Estado: ModificadaAlta (8.8)—

An issue was discovered in Veritas InfoScale 7.x through 7.4.2 on Windows, Storage Foundation through 6.1 on Windows, Storage Foundation HA through 6.1 on Windows, and InfoScale Operations Manager (aka VIOM) Windows Management Server 7.x through 7.4.2. On start-up, it loads the OpenSSL library from \usr\local\ssl. This library attempts to load the \usr\local\ssl\openssl.cnf configuration file, which may not exist.

Leer descripción completaMostrar menos

On Windows systems, this path could translate to <drive>:\usr\local\ssl\openssl.cnf, where <drive> could be the default Windows installation drive such as C:\ or the drive where a Veritas product is installed. By default, on Windows systems, users can create directories under any top-level directory. A low privileged user can create a <drive>:\usr\local\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Veritas — InfoscaleVeritas — Infoscale Operations ManagerVeritas — Storage FoundationVeritas — Storage Foundation AND High Availability

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-36166",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.3,
          "attackVector": "LOCAL",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-01-06T01:15:13.120",
  "references": [
    {
      "url": "https://www.veritas.com/content/support/en_US/security/VTS20-014",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.veritas.com/content/support/en_US/security/VTS20-014",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Veritas InfoScale 7.x through 7.4.2 on Windows, Storage Foundation through 6.1 on Windows, Storage Foundation HA through 6.1 on Windows, and InfoScale Operations Manager (aka VIOM) Windows Management Server 7.x through 7.4.2. On start-up, it loads the OpenSSL library from \\usr\\local\\ssl. This library attempts to load the \\usr\\local\\ssl\\openssl.cnf configuration file, which may not exist. On Windows systems, this path could translate to <drive>:\\usr\\local\\ssl\\openssl.cnf, where <drive> could be the default Windows installation drive such as C:\\ or the drive where a Veritas product is installed. By default, on Windows systems, users can create directories under any top-level directory. A low privileged user can create a <drive>:\\usr\\local\\ssl\\openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en Veritas InfoScale versiones 7.x hasta 7.4.2 en Windows, Storage Foundation versiones hasta 6.1 en Windows, Storage Foundation HA versiones hasta 6.1 en Windows e InfoScale Operations Manager (también se conoce como VIOM) Windows Management Server versiones 7.x hasta 7.4.2 .&#xa0;Al iniciarse, carga la biblioteca OpenSSL desde \\usr\\local\\ssl.&#xa0;Esta biblioteca intenta cargar el archivo de configuración \\usr\\local\\ssl\\openssl.cnf, que puede no estar presente.&#xa0;En los sistemas Windows, esta ruta podría traducirse a (drive):\\usr\\local\\ssl\\openssl.cnf, donde (drive) podría ser la unidad de instalación predeterminada de Windows, como C:\\ o la unidad donde está instalado un producto de Veritas.&#xa0;Por defecto, en los sistemas Windows, los usuarios pueden crear directorios en cualquier directorio de nivel superior.&#xa0;Un usuario poco privilegiado puede crear un archivo de configuración (drive):\\usr\\local\\ssl\\openssl.cnf para cargar un motor OpenSSL malicioso, resultando en una ejecución de código arbitraria como SYSTEM cuando se inicia el servicio.&#xa0;Esto le otorga al atacante acceso de administrador al sistema, permitiendo al atacante (por defecto) acceder a todos los datos, acceder a todas las aplicaciones instaladas, etc"
    }
  ],
  "lastModified": "2026-06-17T03:14:52.890",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:veritas:infoscale:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C5CA35E-248F-44E2-A4E5-FD33422E8EA8",
              "versionEndIncluding": "7.4.2",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:veritas:infoscale_operations_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91E5814D-0C90-480F-A154-D199AF6B7EF4",
              "versionEndIncluding": "7.4.2",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:veritas:storage_foundation:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8CDDBD0A-1513-48DB-B8D1-D61F458B78F8",
              "versionEndIncluding": "6.1"
            },
            {
              "criteria": "cpe:2.3:a:veritas:storage_foundation_and_high_availability:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD526F29-512A-4713-86E1-878755557B29",
              "versionEndIncluding": "6.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}