• EN

Vulnerability in Veeam Backup & Replication - March 2023

regnor
Userlevel 7
Badge +14

Veeam has just informed it’s customers about an existing vulnerability in Veeam Backup & Replication. Unauthorized users may be able to request encrypted credentials from the VBR service, and therefore get access to the backup infrastructure. The KB articles haven’t received updates so far, but the vulnerability did get a CVSSv3 score of 7.5.

EDIT: The KB article has just been published: KB4424

It’s recommended to patch VBR as soon as possible!

Solution

Patches have been released for VBR V11 and V12. Please keep in mind that older releases are also affected, but no longer get fixes. So you need to upgrade your installation to a supported release.

Workaround

As a temporary workaround you can block access to TCP port 9401 on your Veeam Backup & Replication server. This will affect the connection of mount servers to the VBR server, so only use this if you don’t have a distributed Veeam environment. And still apply the patch as soon as possible.

Note about recent deployments

If you have recently deployed V11 or V12 then check the ISO image you’ve used for the installation. 20230227 (V11) and 20230223 (V12) already contain the patches and so aren’t vulnerable anymore.

Max M. | Systems Engineer @Veeam | VMCE/VMCA | former Legend & Vanguard

60 comments

Chris.Childerhose
Userlevel 7
Badge +20

On my Laptop i have Agent 5.0.3.4708 and this version can not read the size of the backup repos on the Veeam Server with the updates components (PATCH IS NOT INSTALLED HERE).
On an other Laptop i installed the newest Veeam Agent for Windows 6.0.0.960 and when i want to create a job with that Agent the Agent says:

 

 

Yes v11 of VBR is not compatible with the V6 agent so you will need to downgrade it to the latest v5 one.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
S

On my Laptop i have Agent 5.0.3.4708 and this version can not read the size of the backup repos on the Veeam Server with the updates components (PATCH IS NOT INSTALLED HERE).
On an other Laptop i installed the newest Veeam Agent for Windows 6.0.0.960 and when i want to create a job with that Agent the Agent says:

 

 

Chris.Childerhose
Userlevel 7
Badge +20

Hi JMeixner

The Agent for Windows (for Client backups) is communicating to a virtual server with Veeam B+R 11.
The client is not managed, its the free edition. I did not update the client Software or that Veeam server installation. I just patched the server installation that is responsible for the backup of our virtual servers

I do not know why the two Veeam servers are connected, my colleague installed the whole Veeam infrastructure.

 

You probably need to update the agent now to get things working again.  Veeam will automatically patch all connected servers in your infrastructure unless you uncheck them.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
S

Hi JMeixner

The Agent for Windows (for Client backups) is communicating to a virtual server with Veeam B+R 11.
The client is not managed, its the free edition. I did not update the client Software or that Veeam server installation. I just patched the server installation that is responsible for the backup of our virtual servers

I do not know why the two Veeam servers are connected, my colleague installed the whole Veeam infrastructure.

 

JMeixner
Userlevel 7
Badge +17

Hi,
is it a server managed or a standalone agent?

Did you upgrade the agent, too?

Jochen (Joe) Meixner | Veeam Vanguard 2024 | Veeam Legend 2021 - 2023 | Veeam Certified Architect (VMCA) 2022 | Twitter: @JoMeix | BlueSky: @jmeixner.bsky.social
S

Dear Community
We have here a physical standalone Veeam Backup Server with Veeam B+R 11 where i installed that Patch yesterday and that worked well i think.

We also have a virtual Veeam Server with Veeam B+R 11 where we save client backups from our Windows Computer with Veeam Agent for Windows (Free Edition) On that System i did not install the Patch


In the productive Veeam Backup Server i see the other server in the “Backup Infrastructure” section as Member.
I do not exactly know why these two Veeam servers are connected, the important one i patched is for Backup of productive virtual servers, the not so important one is for the client backups.

The patch did some component updates on all connected systems (remote repos, backup proxies) and somehow also on that connected Veeam Backup Server for the clients.

 

Now, my Agent for Windows (Free Edition) can not backup our clients anymore, when i edit the existing backup job on a client the client can not get the informations of the backup repository. Message is “failed to retrieve disk space”

 

 

How can i check if that component update is responsible for that problem ?

Is there a way to downgrade the components of that Veeam Server that is responsible for the client backups ?

 

Thank you very much for your help

HunterLAFR
Userlevel 7
Badge +8

Afternoon, I had a reminder from Veeam today that I want to share, before installing this patch, if you have any private fixes / hotfixes, be sure to check with Veeam support that you’re okay to patch before doing so.

thanks for the heads up!

Luis F.- HunterLF - HunterLAFR - lfconsulting.org
MicoolPaul
Userlevel 7
Badge +20

Afternoon, I had a reminder from Veeam today that I want to share, before installing this patch, if you have any private fixes / hotfixes, be sure to check with Veeam support that you’re okay to patch before doing so.

Michael Paul - #VeeamLegend | #VeeamVanguard | Veeam Certified Architect | VMware vExpert | https://micoolpaul.com | Twitter: @MicoolPaul | Mastodon: @micoolpaul@masto.nu | Bluesky: @micoolpaul.bsky.social
Rick Vanover
Userlevel 7
Badge +10

Hi.

After install new version …

Please help.

Jan

 

Problem fixed.  Run as administrator for the first time. 😁

Cool, thanks for sharing.

Twitter @RickVanover | Email: rick.vanover@veeam.com
J
Userlevel 1

Hi.

After install new version …

Please help.

Jan

 

Problem fixed.  Run as administrator for the first time. 😁

J
Userlevel 1

Hi.

After install new version …

Please help.

Jan

 

regnor
Userlevel 7
Badge +14

@pgallengaThank you for the feedback. I’m glad that support could solve this one 😊 Probably not every private hotfix is included in the following CU, so in your case some parts were reverted by the patch.

Max M. | Systems Engineer @Veeam | VMCE/VMCA | former Legend & Vanguard
pgallenga
Userlevel 3
Badge

Hello everybody,

this issue was fixed by Support, that today released us a PrivateFix for the V11a Cumulative Patch5 (P20230227):

Hello everybody,

I’m having issues with one of the v11 installations after applying the patch, with errors like:

Failed to preprocess target Error: Field not found: 'Veeam.Backup.Common.COptions.RetrieveCertUseTls12Only'.  

 

Patching on other infrastructures (both v11 and v12) went smoothly.

Anyone else experiencing the same behaviour?

 

Also 👍 double-thumbs-up 👍 to @regnor  that was right: a private hotfix was applied to that infrastructure a few months ago, and unfortunately the CP5 patch didn’t took that into account.

Doesn't sound so good. 😐 Did you have any (private) hotfixes installed? Anything special about TLS?

 

Great job by the Veeam Support team, that managed to get the backups up and running, and thanks everyone for the support here too!

Chris.Childerhose
Userlevel 7
Badge +20

Thank you. I successfully could make a configuration backup, and mount the ISO. But there is no UPDATE option for me, only an INSTALL option. I’m a little bit confused right now.

At the moment I don’t have official VEEAM support (it is expired a month ago) but of course an official license for VEEAM Backup & Replication 11. Is the expired support the reason why I can’t start an UPDATE?

Use this link that was posted above which is just the patch for 11a - Veeam Software for Enterprise

This will just do the upgrade rather than using the ISO and is smaller.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
N
Userlevel 1

Thank you. I successfully could make a configuration backup, and mount the ISO. But there is no UPDATE option for me, only an INSTALL option. I’m a little bit confused right now.

At the moment I don’t have official VEEAM support (it is expired a month ago) but of course an official license for VEEAM Backup & Replication 11. Is the expired support the reason why I can’t start an UPDATE?

Rick Vanover
Userlevel 7
Badge +10

Hi there,

unfortunately for this task I’m neither an educated nor a professional admin.
Nevertheless I have to update a VBR on an Hyper-V VM running now 11.0.1.1261 P20211211.

I downloaded the iso-file (app. 10GB) “VeeamBackup&Replication_11.0.1.1261_20230227.iso”. But I don’t know what to do know. I guess I have to mount the iso at the VM. But I’m afraid to overwrite all current settings…

Is there a step by step manual? Or could anybody please help me and could explain what I have to do exactly?

Thanks a lot.

Yes, please check out the V11 upgrade center:  http://vee.am/v11upgradecenter (but also the V12 Upgrade Center:  http://vee.am/v12upgradecenter )

Twitter @RickVanover | Email: rick.vanover@veeam.com
Chris.Childerhose
Userlevel 7
Badge +20

Hi there,

unfortunately for this task I’m neither an educated nor a professional admin.
Nevertheless I have to update a VBR on an Hyper-V VM running now 11.0.1.1261 P20211211.

I downloaded the iso-file (app. 10GB) “VeeamBackup&Replication_11.0.1.1261_20230227.iso”. But I don’t know what to do know. I guess I have to mount the iso at the VM. But I’m afraid to overwrite all current settings…

Is there a step by step manual? Or could anybody please help me and could explain what I have to do exactly?

Thanks a lot.

You also have the option to download only the patch file and run that instead of the entire ISO.  But as Joe said it will work but take the configuration backup first.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
JMeixner
Userlevel 7
Badge +17

Do a configuration backup of your Veeam database first.  with this you can recreate your VBR servee in case something happens.

 

With the ISO you can do an update. Normally no settings are overwritten.

There are several guides here in the community, please do  search for “update".

Jochen (Joe) Meixner | Veeam Vanguard 2024 | Veeam Legend 2021 - 2023 | Veeam Certified Architect (VMCA) 2022 | Twitter: @JoMeix | BlueSky: @jmeixner.bsky.social
N
Userlevel 1

Hi there,

unfortunately for this task I’m neither an educated nor a professional admin.
Nevertheless I have to update a VBR on an Hyper-V VM running now 11.0.1.1261 P20211211.

I downloaded the iso-file (app. 10GB) “VeeamBackup&Replication_11.0.1.1261_20230227.iso”. But I don’t know what to do know. I guess I have to mount the iso at the VM. But I’m afraid to overwrite all current settings…

Is there a step by step manual? Or could anybody please help me and could explain what I have to do exactly?

Thanks a lot.

regnor
Userlevel 7
Badge +14

@46er You might only see problems during restores if your repositores aren’t hosted by the Veeam backup server itself.

But, if you’re still on VBR v9 you have much worse unpatched vulnerabilities:

https://www.veeam.com/kb4288?ad=in-text-link

https://www.veeam.com/kb4289?ad=in-text-link

https://www.veeam.com/kb4290?ad=in-text-link

I wouldn’t wait any longer to patch your environment. Especially as there are known attacks using the vulnerabilities above.

Max M. | Systems Engineer @Veeam | VMCE/VMCA | former Legend & Vanguard
Chris.Childerhose
Userlevel 7
Badge +20

Hi all,

 

Long story short. Will be upgrading from v9 soon; till then I was planning on blocking port 9401.

From my understanding this will only affect being able to restore files, does anyone know if blocking this port will affect backing up our VMs?

No this port should not affect backups as it is Mount Server related as per here - https://helpcenter.veeam.com/docs/backup/vsphere/used_ports.html?ver=120#mount-server-connections

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
Rick Vanover
Userlevel 7
Badge +10

I keep getting the same error to stop and disable all jobs. I have made sure there are no running jobs and have rebooted the server. Do I need to disable all jobs even if they aren’t running?

 

One trick I’ve done for this message is reboot, and before the services start back up - run the hotfix. 

 

If you still can’t get it installed - I’d recommend you open a support ticket.

Twitter @RickVanover | Email: rick.vanover@veeam.com
4

Hi all,

 

Long story short. Will be upgrading from v9 soon; till then I was planning on blocking port 9401.

From my understanding this will only affect being able to restore files, does anyone know if blocking this port will affect backing up our VMs?

regnor
Userlevel 7
Badge +14

I keep getting the same error to stop and disable all jobs. I have made sure there are no running jobs and have rebooted the server. Do I need to disable all jobs even if they aren’t running?

 

@Cassy.Haley You only need to disable jobs, which are continuously running. Like copy jobs or tape jobs for example. Also make sure no Veeam Backup Console is open.

Max M. | Systems Engineer @Veeam | VMCE/VMCA | former Legend & Vanguard
Chris.Childerhose
Userlevel 7
Badge +20

I keep getting the same error to stop and disable all jobs. I have made sure there are no running jobs and have rebooted the server. Do I need to disable all jobs even if they aren’t running?

 

Always a safe bet to disable everything.  Makes things easier for updates/upgrades.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech

Comment


Terms & Conditions