{"uuid": "85549324-1cc2-4db5-8e29-83e1dc6a3660", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2004-1172", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/backupexec/name_service.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"hdm \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in the Veritas Backup\\n          Exec Agent Browser service. This vulnerability occurs when a\\n          recv() call has a length value too long for the\\tdestination\\n          stack buffer. By sending an agent name value of 63 bytes or\\n          more, we can overwrite the return address of the recv\\n          function. Since we only have ~60 bytes of contiguous space\\n          for shellcode, a tiny findsock payload is sent which uses a\\n          hardcoded IAT address for the recv() function. This payload\\n          will then roll the stack back to the beginning of the page,\\n          recv() the real shellcode into it, and jump to it. This\\n          module has been tested against Veritas 9.1 SP0, 9.1 SP1, and\\n          8.6.\", \"disclosure_date\": \"2004-12-16\", \"fullname\": \"exploit/windows/backupexec/name_service\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 17:11:13 +0000\", \"name\": \"Veritas Backup Exec Name Service Overflow\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/backupexec/name_service.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 200, \"ref_name\": \"windows/backupexec/name_service\", \"references\": [\"CVE-2004-1172\", \"OSVDB-12418\", \"BID-11974\", \"URL-http://www.idefense.com/application/poi/display?id=169&type=vulnerabilities\"], \"rport\": 6101, \"session_types\": false, \"targets\": [\"Veritas BE 9.1 SP0/SP1\", \"Veritas BE 8.5\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:54.333250Z"}