Vulnerability Scanner Detection Related to CVE-2023-38545
Purpose
Impact Statement
False Positive Alerts
Vulnerability detection software may issue false positive alerts based merely on the fact that the libcurl library file is present on a machine where the Veeam Transport Service has been deployed. Below is a list of component roles where Veeam Backup & Replication deploys the Veeam Transport Service for data movement purposes, meaning that the libcurl file contained in the VDDK libraries will also be found on servers holding these roles:
- Veeam Agent for Microsoft Windows Deployment Managed by Backup Server
- Veeam Agent for Linux Deployment Managed by Backup Server
- VMware Backup Proxy
- CDP Proxy
- Gateway Server
- Windows Backup Repository
- Linux Backup Repository
- Hardened Repository
- Tape Server
- WAN Accelerator
- Persistent Agent Components
- Log Shipping Server
- Mount Server
False Positive Alert Mitigation
Mitigation Explanation
Mitigation involves the removal of VDDK, which contains the libcurl library, from machines where it is not needed. It is crucial that VDDK not be removed from any machine with a role that requires the capability to communicate with the VMware vSphere environment.
Roles where VDDK must not be removed as it would impact the ability to communicate with the VMware vSphere environment:
- Veeam Backup Server
- VMware Backup Proxy
- Guest Interaction Proxy
- CDP Proxy
Please note that the presence of VDDK on any other Veeam components or on protected machines that do not carry the above roles does not represent even a theoretical threat because VDDK is never used or called from the Veeam code on those machines.
Implementation of Mitigation
If you have any questions or concerns, please do not hesitate to create a Veeam Support case.
For each machine that your security software has alerted to the presence of the libcurl library:
- Review whether the machine is a part of the VMware vSphere backup infrastructure.
Reference the list of roles within the Mitigation Explanation section above. - If the machine does not carry one of those roles, use the commands below to remove the VDDK libraries that contain the libcurl library.
Linux Machines
To remove the VDDK libraries on a Linux machine, use the following command:
Windows Machines
To remove the VDDK libraries from a Windows machine, use the following commands:
More Information
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.