CVE-2017-8895 Use after free in n/a

What is CVE-2017-8895?

CVE-2017-8895 is a critical use after free vulnerability in n/a, published on 10 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution. An unauthenticated attacker can use this vulnerability to crash the agent or potentially take control of the agent process and then the system it is running on.

Weakness: CWE-416

Which versions are affected by CVE-2017-8895?

It affects 1 product.

Products include Veritas Backup Exec.

How do I fix CVE-2017-8895?

No fix has been published for CVE-2017-8895 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2017-8895 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-8895 exists.

Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2021-27878 Veritas Backup Exec Agent Command Execution Exploited High 8.8
• CVE-2021-27877 Veritas Backup Exec Agent Improper Authentication Exploited High 8.2
• CVE-2021-27876 Veritas Backup Exec Agent File Access Exploited High 8.1
• CVE-2020-36167 Path traversal in n/a Critical 9.3
• CVE-2024-33673 Privilege escalation in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-65x9-x5m2-cp2g.