Rule:--Sid:3809--Summary:This event is generated when an attempt is made to exploit a knownvulnerability in Veritas Backup Exec Server.--Impact:A successful attack can allow an attacker to manipulate system registrysetting on the target host.--Detailed Information:A vulnerability exists in the Veritas Backup Server handles DCERPCrequests that attempt to alter registry values, enabling an attacker tomodify the registry.The Backup Server accepts anonymous client requests, but fails toassign the appropriate privileges.  This allows an attacker to performprivileged tasks on the server.  One such task is altering registryvalues.This is done over TCP port 6106 using the DCOM identifier of93841fd0-16ce-11ce-850d-02608c44967b.  An attack must bind to this IDand then make a request for this ID.--Affected Systems:  Backup Exec 10.0 for Windows Servers rev. 5484  Backup Exec 9.1 for Windows Servers rev. 4691  Backup Exec 9.0 for Windows Servers rev. 4454  Backup Exec 9.0 for Windows Servers rev. 4367--Attack Scenarios:An attacker can craft a message to the server using the appropriateDCOM identifier to gain unauthorized administrative access to the host.--Ease of Attack:Simple. Exploits are publicly available.--False Positives:None known.--False Negatives:None known.--Corrective Action:Upgrade to the most current non-affected version of the product.--Contributors:Sourcefire Vulnerability Research TeamBrian Caswell <bmc@sourcefire.com>Judy Novak <judy.novak@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional ReferencesiDefense:http://www.idefense.com/application/poi/display?id=232&type=vulnerabilities--