CISA Orders Veritas Patches

Summary

CISA adds Veritas Backup Exec vulnerabilities to its ‘Must Patch’ list due to ransomware attacks. These vulnerabilities, disclosed in 2021, allow unauthorized access and command execution. Federal agencies must patch immediately, and other organizations should prioritize updates to protect against ransomware like Alphv/BlackCat.

Dont let data threats slow you downTrueNAS offers enterprise-level protection.

** Main Story**

The Cybersecurity and Infrastructure Security Agency (CISA) recently escalated its response to vulnerabilities in Veritas Backup Exec software by adding them to its “Must Patch” list. This action mandates immediate patching by federal agencies and strongly urges other organizations to prioritize these updates. This decisive move underscores the severe risk these vulnerabilities pose, particularly their exploitation by ransomware gangs like Alphv (also known as BlackCat).

The Veritas Vulnerabilities and Ransomware Threat

The vulnerabilities, tracked as CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878, reside within the SHA Authentication scheme of the Veritas Backup Exec agent. These flaws enable attackers to gain unauthorized access to systems, execute arbitrary commands, and potentially exfiltrate or encrypt sensitive data. While Veritas addressed these issues with patches released in 2021 (specifically with version 21.2), a significant number of systems remain unpatched, making them easy targets for ransomware attacks.

Ransomware groups, particularly Alphv/BlackCat, have actively exploited these vulnerabilities for initial access to target networks. This tactic deviates from their typical reliance on stolen credentials, highlighting the ease and effectiveness of exploiting these flaws. Mandiant, a cybersecurity firm, reported observing an Alphv affiliate, tracked as UNC4466, exploiting these vulnerabilities using a publicly available Metasploit module. This module allows attackers to establish a session and interact with compromised systems, setting the stage for further malicious activities. The exploitation process observed by Mandiant involved leveraging the Metasploit module to gain initial access, followed by reconnaissance using tools like Advanced IP Scanner and ADRecon. The attackers then used the Background Intelligent Transfer Service (BITS) to download additional tools like LAZAGNE, LIGOLO, WINSW, RCLONE, and finally, the ALPHV ransomware encryptor.

CISA’s ‘Must Patch’ Directive and Its Implications

CISA’s directive carries significant weight for federal agencies, requiring them to patch these vulnerabilities without delay. This action underscores the criticality of these flaws and the urgent need for remediation. The inclusion of these vulnerabilities in the “Must Patch” list publicly emphasizes the potential for widespread exploitation and disruption. This public announcement serves as a warning to organizations of all sizes and sectors, emphasizing the importance of prioritizing these patches.

Beyond the immediate patching requirement for federal agencies, CISA’s directive serves as a broader call to action for the cybersecurity community. It underscores the need for organizations to maintain up-to-date software and implement robust vulnerability management practices. By highlighting the real-world exploitation of these flaws, CISA aims to motivate organizations to proactively address vulnerabilities before they become entry points for ransomware and other cyberattacks.

Recommendations for Protecting Your Systems

To mitigate the risks associated with these Veritas Backup Exec vulnerabilities, organizations should take the following steps:

• Update Immediately: The most crucial step is to immediately update all instances of Veritas Backup Exec to version 21.2 or later. This update applies the necessary patches to address the vulnerabilities. If updating to the latest version is not immediately feasible, apply the specific hotfixes provided by Veritas.
• Regular Patching: Implement a regular patching schedule to ensure all software, including backup solutions, remains up-to-date. Timely patching significantly reduces the window of vulnerability for exploitation. Regularly consult vendor advisories and security updates for information on relevant patches.
• Vulnerability Scanning: Regularly scan systems for vulnerabilities, including those related to Veritas Backup Exec. Vulnerability scanners can help identify unpatched systems and prioritize remediation efforts. Employ both internal and external vulnerability scanning to cover all potential attack vectors.
• Network Monitoring: Implement robust network monitoring to detect suspicious activity, such as unauthorized access attempts or unusual data transfers. Early detection can help prevent or contain attacks before they escalate. Network segmentation can further limit the impact of a successful breach.
• Security Audits: Conduct regular security audits to assess the overall security posture of your environment, including backup systems. Audits can identify weaknesses and inform improvements to security practices. Regularly review and update your incident response plan.
• Least Privilege Access: Implement the principle of least privilege, granting users only the necessary access rights to perform their duties. This practice limits the potential impact of compromised accounts. Regularly review user access rights and revoke unnecessary privileges.
• Multi-Factor Authentication (MFA): Enable MFA for all accounts, especially those with administrative privileges. MFA adds an extra layer of security, making it more difficult for attackers to gain unauthorized access, even with stolen credentials.

The exploitation of Veritas Backup Exec vulnerabilities by ransomware groups serves as a stark reminder of the importance of proactive vulnerability management. CISA’s directive, while specifically targeted at federal agencies, should be a wake-up call for all organizations. By taking swift action to patch these vulnerabilities and implement robust security practices, organizations can significantly reduce their risk of falling victim to ransomware attacks. Note: This information is current as of March 8, 2025. The threat landscape constantly evolves, so it is important to stay informed about emerging threats and update security practices accordingly.