{"schemaVersion":3,"id":"CVE-2017-8895","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution. An unauthenticated attacker can use this vulnerability to crash the agent or potentially take control of the agent process and then the system it is running on.","dates":{"published":"2017-05-10T21:00:00.000Z","modified":"2024-08-05T16:48:22.653Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.71003,"percentile":0.99401,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.71003},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.67355,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.71003,"percentile":0.99401}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.67355,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.71003,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.71003,"percentile":0.99401}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"42282","name":"Veritas/Symantec Backup Exec - SSL NDMP Connection Use-After-Free (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/42282","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/42282.rb","codes":["CVE-2017-8895"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_BACKUPEXEC_SSL_UAF","name":"Veritas/Symantec Backup Exec SSL NDMP Connection Use-After-Free","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/backupexec/ssl_uaf.rb","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/backupexec/ssl_uaf","rank":"300","rankName":"normal","postAuth":false,"check":true,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-416","name":"Use After Free","description":"The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","type":"weakness","status":"Stable","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/416.html"}],"affected":[{"vendor":"veritas","product":"backup_exec","name":"backup exec","label":"backup_exec","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 14.1.1786.1126","noFixRecorded":false,"fixedIn":null},{"text":"< 14.2.1180.3160","noFixRecorded":false,"fixedIn":null},{"text":"< 16.0.1142.1327","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 14.1.1786.1126 | < 14.2.1180.3160 | < 16.0.1142.1327","eol":null,"hubHref":"/vendor/veritas/backup_exec"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/98386","label":"www.securityfocus.com/bid/98386","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://www.veritas.com/content/support/en_US/security/VTS17-006.html#Issue1","label":"www.veritas.com/content/support/en_US/security/VTS17-006.html","hostname":"www.veritas.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1038561","label":"www.securitytracker.com/id/1038561","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42282/","label":"www.exploit-db.com/exploits/42282/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2017-05-10T21:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T16:48:22.653Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T21:20:04.777Z","stale":false,"partial":false}}