Veeam patches multiple critical remote code execution flaws
Data backup and cloud data management company Veeam said it has released multiple patches that fix more than a dozen bugs affecting various products. In a security advisory published earlier this week, Veeam said it has fixed 18 bugs in total, five of which are considered critical in severity.
The first is an unauthenticated remote code execution vulnerability found in Veeam Backup & Replication. It is tracked as CVE-2024-40711 and has a severity rating of 9.8. The second and third flaws were found in Veeam ONE. CVE-2024-42024, with a severity rating of 9.1, allows threat actors with Agent service account credentials to perform remote code execution.
CVE-2024-42019, on the other hand, has a slightly lower severity score (9.0) and allows attackers to access the NTLM hash of the Veeam Reporter Service account.
Safe versions
Then there’s a 9.9 severity bug in Veeam Service Provider Console, which allows low-privileged attackers to access the NTLM hash of the service account on the server. This is tracked as CVE-2024-38650. Finally, CVE-2024-39714, also a 9.9 flaw, was found in the same software and allows low-privileged users to upload arbitrary files.
The remaining 13 flaws are generally of high severity and allow for bypassing multi-factor authentication (MFA), allowing privilege escalation, remote code execution (RCE), and more.
To ensure the security of their infrastructure, users are advised to update their software to the following versions:
- Veeam Backup & Replication 12.2 (build 12.2.0.334)
- Veeam Agent for Linux 6.2 (build 6.2.0.101)
- Veeam ONE v12.2 (build 12.2.0.4093)
- Veeam Service Provider Console v8.1 (build 8.1.0.21377)
- Veeam Backup for Nutanix AHV Plug-In v12.6.0.632
- Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization Plug-In v12.5.0.299
Via The Hacker News