CVE-2020-36169
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn issue was discovered in Veritas NetBackup through 8.3.0.1 and OpsCenter through 8.3.0.1. Processes using OpenSSL attempt to load and execute libraries from paths that do not exist by default on the Windows operating system. By default, on Windows systems, users can create directories under the top level of any drive. If a low privileged user creates an affected path with a library that the Veritas product attempts to load, they can execute arbitrary code as SYSTEM or Administrator. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc. This vulnerability affects master servers, media servers, clients, and OpsCenter servers on the Windows platform. The system is vulnerable during an install or upgrade and post-install during normal operations.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceDLL hijacking vulnerability in Veritas NetBackup and OpsCenter on Windows. OpenSSL processes attempt to load libraries from paths that don't exist by default on Windows. Low-privileged users can create these paths and plant malicious libraries, allowing execution as SYSTEM/Administrator. Affects master servers, media servers, clients, and OpsCenter servers during install/upgrade and normal operations.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data<= 8.3.0.1<= 8.3.0.1CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed Veritas productsCheck for NetBackup or OpsCenter installations by examining Program Files/Veritas directories, or run 'reg query HKLM\Software\Veritas' to query the Windows registry for Veritas product entriesAffected if NetBackup or OpsCenter is present on the system
-
Determine installed versionLocate version information in the registry at HKLM\Software\Veritas\NetBackup\CurrentVersion or HKLM\Software\Veritas\OpsCenter\CurrentVersion, or check the 'About' dialog in the NetBackup Administration Console or OpsCenter web interfaceAffected if The installed version is 8.3.0.1 or earlier for either product
-
Identify vulnerable OpenSSL library search pathsExamine the OpenSSL configuration used by NetBackup or monitor process DLL loading with tools like Process Monitor (procmon.exe) from Sysinternals to identify which paths the openssl.exe or related processes attempt to load DLLs fromAffected if OpenSSL processes attempt to load DLLs from non-standard paths that do not exist by default on Windows
-
Check filesystem permissions on vulnerable pathsUse icacls.exe or the Security tab in folder Properties to examine permissions on the paths identified in the previous step. Specifically check if low-privileged users have Create Folder permission (or Write DAC) on parent directoriesAffected if Low-privileged users can create new directories at the paths where OpenSSL attempts to load DLLs
-
Inspect for unexpected DLLsExamine the directories where OpenSSL loads libraries from, looking for any DLL files that were not part of a legitimate Veritas or OpenSSL installation. Compare against known-good OpenSSL DLL files from a clean installAffected if Unexpected or unauthorized DLL files exist in the library search paths used by NetBackup or OpsCenter OpenSSL processes
A system is affected if NetBackup or OpsCenter version 8.3.0.1 or earlier is installed AND low-privileged users can create directories at paths where OpenSSL attempts to load DLLs, allowing potential DLL hijacking to achieve elevated privileges.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataApply vendor patches for NetBackup and OpsCenter to version 8.3.0.1 or later. Restrict filesystem permissions to prevent low-privileged users from creating directories at affected paths.
- Consultation8.0 h
- Implementation16.0 h
- Testing12.0 h
- Review / QA6.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $11,776.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2020-36169 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2020-36169 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data