The vulnerability exists within the function responsible for receiving and parsing registration requests. The registration request packet contains the hostname and connecting TCP port of the client which is stored in an array on the stack. An attacker can send a registration request with an overly long hostname value to overflow the array and take control of the saved return address, thereby executing arbitrary code.
Impact
Successful exploitation does not require authentication thereby allowing any remote attacker to execute arbitrary code under the privileges of the Backup Exec Agent Browser (benetns.exe) process which is usually a domain administrative account.
Workaround
Use a firewall to restrict incoming connections to trusted workstations running the Backup Exec client software.
Vendor Status:
The vendor has released a hotfix that addresses this vulnerability.
