DESCRIPTION
Remote exploitation of an access validation vulnerability in Veritas Backup Exec for Windows provides attackers with 'Administrator' privileges over the target system's registry.

The problem specifically exists within some RPC handlers defined in beserver.exe. The Backup Exec Server service registers an RPC interface on a TCP endpoint with ID 93841fd0-16ce-11ce-850d-02608c44967b on port 6106. The following assembly snippet from beserver.exe version 10.0.5484.0 shows the server-side RPC dispatch table for this interface:

    rpc_dispatch_table_1
      .text:00425E28 dd offset rpc_sub_1
      .text:00425E2C dd offset rpc_sub_2
      .text:00425E30 dd offset rpc_sub_3
      .text:00425E34 dd offset rpc_sub_4
      .text:00425E38 dd offset rpc_sub_5  ; registry read
      .text:00425E3C dd offset rpc_sub_6  ; registry write
      .text:00425E40 dd offset rpc_sub_7  ; registry delete
      .text:00425E44 dd offset rpc_sub_8  ; registry enum
      .text:00425E48 dd offset rpc_sub_9
      .text:00425E4C dd offset rpc_sub_10
      .text:00425E50 dd offset rpc_sub_11
      .text:00425E54 dd offset null_sub
      .text:00425E58 dd offset null_sub

The above marked routines allow unauthenticated remote attackers to connect to the RPC endpoint and arbitrarily create, modify, delete and read keys. An attacker needs only to reverse engineer the Microsoft Interface Description Language (IDL) for the target routine and create a custom client to connect to and manipulate the server. The IDL definition for rpc_sub_6 is:

    long rpc_sub_6 (
      /* 04 */ [in] [string] wchar_t *sub_key,
      /* 08 */ [in] [string] wchar_t *value_name,
      /* 0C */ [in] long type,
      /* 10 */ [in] long len_data,
      /* 14 */ [in,out] [size_is(len_data)] byte *data,
      /* 18 */ [in] long len_hkey,
      /* 1C */ [in] [size_is(len_hkey)] byte *hkey
    );

ANALYSIS
Successful exploitation of the described vulnerability allows unauthenticated remote attackers to connect to and arbitrarily modify the target systems registry under the privileges of the 'Administrator' user. Registry write access can be leveraged in a number of ways to further compromise the target system. A simple vector would involve writing values to startup keys with UNC paths to malicious binaries.

EXPLOIT CODE
H D Moore of Metasploit has created an MSF exploit module for this issue available at www.metasploit.com

iDEFENSE Advisory