CVE-2020-36165
First published: Wed Jan 06 2021(Updated: )
An issue was discovered in Veritas Desktop and Laptop Option (DLO) before 9.4. On start-up, it loads the OpenSSL library from /ReleaseX64/ssl. This library attempts to load the /ReleaseX64/ssl/openssl.cnf configuration file, which does not exist. By default, on Windows systems, users can create directories under C:\. A low privileged user can create a C:/ReleaseX64/ssl/openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc. This impacts DLO server and client installations.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Veritas Desktop and Laptop Option | <9.4 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-36165.
What is the severity level of CVE-2020-36165?
The severity level of CVE-2020-36165 is critical with a score of 8.8.
What is the affected software for CVE-2020-36165?
The affected software for CVE-2020-36165 is Veritas Desktop and Laptop Option (DLO) before version 9.4.
How does the vulnerability in Veritas Desktop and Laptop Option (DLO) affect Windows systems?
The vulnerability in Veritas Desktop and Laptop Option (DLO) does not affect Windows systems.
Is there any fix or patch available for CVE-2020-36165?
Veritas has released a fix for CVE-2020-36165 in version 9.4 of Veritas Desktop and Laptop Option (DLO). Please refer to the Veritas security advisory for more information.
- collector/nvd-index
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- vendor/veritas
- canonical/veritas desktop and laptop option
- vendor/microsoft
- canonical/microsoft windows