Security Advisory 10-27-2014

Two vulnerabilities have been identified in Server Backup Manager.   



h2. Severity

R1Soft  rates these vulnerabilities as Critical..

h2. Risk Assessment

An information exposure vulnerability was discovered in the Server Backup Manager.   This could result in a SBM user's session being cloned, allowing a malicious use access to SBM with that user's permissions.  R1Soft thanks [www.rack911.com|http://www.rack911.com/] for bringing this issue to our attention and working closely with us on resolution.

The SSL v3 vulnerability, CVE 2014-3566,  known as POODLE, affects Server Backup Manager.   This attack compromises encryption and could allow an attacker to get user credentials and session tokens. 


h2. Risk Mitigation


Immediately upgrade the Server Backup Manager to version 5.8.1. 




h2. Vulnerability

Affected versions include  Server Backup Manager 5.8.0 and earlier.





h2. Fix

{note:title=Upgrade Note: Server Backup Advanced users}