List of Security Fixes and Improvements in Veeam Agent for Microsoft Windows

This article describes all security-related fixes and improvements introduced in each release or update of Veeam Agent for Microsoft Windows.

This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases to help them make an informed decision on whether it is critical to upgrade from their current Veeam Agent for Microsoft Windows version to a later one.

6.0.2.1090

• OpenSSL Library updated to the newest version (1.0.2zg).
   

6.0.0.960

• Added support for networks with NTLM authentication disabled (Kerberos-only authentication).
• Audit capabilities were improved
• zlib has been updated to version 1.2.13
• OpenSSL version has been updated to 1.0.2ze
   

5.0.3.4708

• Vulnerability (CVE-2022-26503) in Veeam Agent for Microsoft Windows was fixed.
  This vulnerability was reported by Nikita Petrov (Positive Technologies).
   

5.0.0.4301

• LZ4 compression library version has been updated to version 1.9.2
   

4.0.2.2208

• Vulnerability (CVE-2022-26503) in Veeam Agent for Microsoft Windows was fixed.
  This vulnerability was reported by Nikita Petrov (Positive Technologies).
   

4.0.0.1811

• A custom security descriptor was provided for the driver's control device (vulnerability reported by Mile Karry).
• Deserialization issues were fixed (vulnerability reported by Harrison Neal).
• A user authorization issue was fixed (vulnerability reported by Harrison Neal).
• OpenSSL was updated to version 1.0.2t

As we're establishing this new process, we appreciate any feedback on the content or format of this KB article. Please let us know in the related topic on the Veeam R&D Forums. If your feedback is too sensitive to be shared publicly, please submit it by opening a support case. We highly appreciate your collaboration!