Veeam Warns of Critical Vulnerability in Service Provider Co…
Veeam Warns of Critical Vulnerability in Service Provider Console[1] Backup, recovery, and data protection firm Veeam has released patches for two Veeam Service Provider Console vulnerabilities, including a critical severity flaw that can lead to remote code execution (RCE). The Service Provider Console is a cloud-enabled platform enabling users to manage and monitor data protection operations and services across physical, virtual, and cloud-based Veeam solutions. The critical security defect disclosed on Tuesday, which was tracked as CVE-2024-42448 (CVSS score of 9.9), could lead to RCE on the Service Provider Console server. “From the VSPC management agent machine, under the condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine,” Veeam warned in an advisory. The second bug could be exploited under the same conditions to “leak an NTLM hash of the VSPC server service account and delete files on the VSPC server machine. The flaw is tracked as CVE-2024-42449 (CVSS score of 7.1). The company said that Veeam Service Provider Console version 8.1.0.21377 and all version 7 and 8 build numbers are affected. Earlier versions, which are no longer supported, could also be impacted. Both vulnerabilities were discovered during internal testing, and their patches were included in Veeam Service Provider Console version 8.1.0.21999. However, the company says no mitigation action is available for either. “We encourage service providers using supported versions of Veeam Service Provider Console (versions 7 & 8) to update to the latest cumulative patch. Service Providers using unsupported versions are strongly encouraged to upgrade to the latest version of Veeam Service Provider Console,” Veeam added. During the vulnerability analysis (stage 5 of PASTA), we identified several vulnerabilities that could affect the security of the system’s operation. The previous report describes these vulnerabilities. Create the required misuse cases diagram and design the flaw analysis using the abuse cases to define the required mitigations (at least one for each misuse case). Submission: The complete UML diagram misuse is compounded by the use cases to the system, the misuse cases, and the required mitigations. The diagram must be made using Visual Paradigm[2]. Submissions of any other diagram or diagrams built into a paper will not be considered and will receive zero points in the activity. Rubric: The student submits an accurate UML Use Case diagram based on the information provided (until 5 points). Based on the information provided, the student updated the previous Use Case Diagram with an accurate UML Misuse Case Diagram that is corrected and mapped to the previous UML Use Case Diagram (until 15 points). Based on the information provided, the student updated the previous Misuse Case Diagram, including the required mitigations, and mapped them to the misuse cases. There are no mistakes; for example, the type of mitigation did not make sense for the threats that were wanted to be mitigated (until 30 points). [1] https://www.securityweek.com/veeam-warns-of-critical-vulnerability-in-service-provider-console/ [2] https://online.visual-paradigm.com/
Read Details