{"api_version":"1","generated_at":"2026-07-23T10:26:27+00:00","cve":"CVE-2006-0991","urls":{"html":"https://cve.report/CVE-2006-0991","api":"https://cve.report/api/cve/CVE-2006-0991.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-0991","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-0991"},"summary":{"title":"CVE-2006-0991","description":"Buffer overflow in the NetBackup Sharepoint Services server daemon (bpspsserver) on NetBackup 6.0 for Windows allows remote attackers to execute arbitrary code via crafted \"Request Service\" packets to the vnetd service (TCP port 13724).","state":"PUBLISHED","assigner":"mitre","published_at":"2006-03-28 00:06:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.1","severity":"","vector":"AV:N/AC:H/Au:S/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:C/I:C/A:C","baseScore":7.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25473","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25473","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/1124","name":"http://www.vupen.com/english/advisories/2006/1124","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/19417","name":"http://secunia.com/advisories/19417","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Veritas NetBackup Multiple Buffer Overflow Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/428979/100/0/threaded","name":"http://www.securityfocus.com/archive/1/428979/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/377441","name":"http://www.kb.cert.org/vuls/id/377441","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"US-CERT Vulnerability Note VU#377441","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/17264","name":"http://www.securityfocus.com/bid/17264","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"VERITAS NetBackup Multiple Remote Buffer Overflow Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://securitytracker.com/id?1015832","name":"http://securitytracker.com/id?1015832","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - Veritas NetBackup Buffer Overflows in vmd, bpdbm, and bpspsserver Daemons Let Remote Users Execute Arbitrary Code","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityresponse.symantec.com/avcenter/security/Content/2006.03.27.html","name":"http://securityresponse.symantec.com/avcenter/security/Content/2006.03.27.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Veritas NetBackup:  Multiple Overflow Vulnerabilities in NetBackup Daemons","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seer.support.veritas.com/docs/281521.htm","name":"http://seer.support.veritas.com/docs/281521.htm","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Symantec Security Advisory SYM06-006:  Multiple overflow vulnerabilities exist in Veritas NetBackup (tm) daemons that could potentially lead to execution of arbitrary code resulting in possible unauthorized, elevated privileged access to the targeted system.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.tippingpoint.com/security/advisories/TSRT-06-01.html","name":"http://www.tippingpoint.com/security/advisories/TSRT-06-01.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Intrusion Prevention IPS | TippingPoint, a division of 3Com | Published Advisories","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-0991","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-0991","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"991","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"veritas","cpe5":"netbackup","cpe6":"4.5.0","cpe7":"fp","cpe8":"businessserver","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"991","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"veritas","cpe5":"netbackup","cpe6":"4.5.0","cpe7":"fp","cpe8":"datacenter","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"991","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"veritas","cpe5":"netbackup","cpe6":"4.5.0","cpe7":"mp","cpe8":"businessserver","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"991","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"veritas","cpe5":"netbackup","cpe6":"4.5.0","cpe7":"mp","cpe8":"datacenter","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"991","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"veritas","cpe5":"netbackup","cpe6":"5.0","cpe7":"*","cpe8":"enterprise_server","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"991","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"veritas","cpe5":"netbackup","cpe6":"5.0","cpe7":"*","cpe8":"server","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"991","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"veritas","cpe5":"netbackup","cpe6":"5.1","cpe7":"*","cpe8":"enterprise_server","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"991","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"veritas","cpe5":"netbackup","cpe6":"5.1","cpe7":"*","cpe8":"server","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"991","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"veritas","cpe5":"netbackup","cpe6":"6.0","cpe7":"*","cpe8":"enterprise_server","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"991","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"veritas","cpe5":"netbackup","cpe6":"6.0","cpe7":"*","cpe8":"server","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2006","cve_id":"991","cve":"CVE-2006-0991","epss":"0.290710000","percentile":"0.965910000","score_date":"2026-04-19","updated_at":"2026-04-20 00:11:20"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T16:56:14.482Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1015832","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1015832"},{"name":"17264","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/17264"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://seer.support.veritas.com/docs/281521.htm"},{"name":"19417","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/19417"},{"name":"ADV-2006-1124","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/1124"},{"name":"netbackup-vnetd-bo(25473)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25473"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://securityresponse.symantec.com/avcenter/security/Content/2006.03.27.html"},{"name":"20060327 TSRT-06-01: Symantec VERITAS NetBackup vnetd Buffer Overflow Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/428979/100/0/threaded"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.tippingpoint.com/security/advisories/TSRT-06-01.html"},{"name":"VU#377441","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/377441"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-03-27T00:00:00.000Z","descriptions":[{"lang":"en","value":"Buffer overflow in the NetBackup Sharepoint Services server daemon (bpspsserver) on NetBackup 6.0 for Windows allows remote attackers to execute arbitrary code via crafted \"Request Service\" packets to the vnetd service (TCP port 13724)."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-18T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"1015832","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1015832"},{"name":"17264","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/17264"},{"tags":["x_refsource_CONFIRM"],"url":"http://seer.support.veritas.com/docs/281521.htm"},{"name":"19417","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/19417"},{"name":"ADV-2006-1124","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/1124"},{"name":"netbackup-vnetd-bo(25473)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25473"},{"tags":["x_refsource_CONFIRM"],"url":"http://securityresponse.symantec.com/avcenter/security/Content/2006.03.27.html"},{"name":"20060327 TSRT-06-01: Symantec VERITAS NetBackup vnetd Buffer Overflow Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/428979/100/0/threaded"},{"tags":["x_refsource_MISC"],"url":"http://www.tippingpoint.com/security/advisories/TSRT-06-01.html"},{"name":"VU#377441","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/377441"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-0991","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Buffer overflow in the NetBackup Sharepoint Services server daemon (bpspsserver) on NetBackup 6.0 for Windows allows remote attackers to execute arbitrary code via crafted \"Request Service\" packets to the vnetd service (TCP port 13724)."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1015832","refsource":"SECTRACK","url":"http://securitytracker.com/id?1015832"},{"name":"17264","refsource":"BID","url":"http://www.securityfocus.com/bid/17264"},{"name":"http://seer.support.veritas.com/docs/281521.htm","refsource":"CONFIRM","url":"http://seer.support.veritas.com/docs/281521.htm"},{"name":"19417","refsource":"SECUNIA","url":"http://secunia.com/advisories/19417"},{"name":"ADV-2006-1124","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/1124"},{"name":"netbackup-vnetd-bo(25473)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25473"},{"name":"http://securityresponse.symantec.com/avcenter/security/Content/2006.03.27.html","refsource":"CONFIRM","url":"http://securityresponse.symantec.com/avcenter/security/Content/2006.03.27.html"},{"name":"20060327 TSRT-06-01: Symantec VERITAS NetBackup vnetd Buffer Overflow Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/428979/100/0/threaded"},{"name":"http://www.tippingpoint.com/security/advisories/TSRT-06-01.html","refsource":"MISC","url":"http://www.tippingpoint.com/security/advisories/TSRT-06-01.html"},{"name":"VU#377441","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/377441"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-0991","datePublished":"2006-03-28T00:00:00.000Z","dateReserved":"2006-03-03T00:00:00.000Z","dateUpdated":"2024-08-07T16:56:14.482Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-03-28 00:06:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:C/I:C/A:C","baseScore":7.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":3.9,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:veritas:netbackup:4.5.0:fp:businessserver:*:*:*:*:*","matchCriteriaId":"74DFFDE3-533A-4F35-949A-C85CBFCD7C87"},{"vulnerable":true,"criteria":"cpe:2.3:a:veritas:netbackup:4.5.0:fp:datacenter:*:*:*:*:*","matchCriteriaId":"F7B2572C-C560-4D7F-8824-A04DA07583FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:veritas:netbackup:4.5.0:mp:businessserver:*:*:*:*:*","matchCriteriaId":"BCA898F1-6E9A-41DE-ABB3-4006D16CF315"},{"vulnerable":true,"criteria":"cpe:2.3:a:veritas:netbackup:4.5.0:mp:datacenter:*:*:*:*:*","matchCriteriaId":"6F18487E-ADA8-4362-9F50-73568716825A"},{"vulnerable":true,"criteria":"cpe:2.3:a:veritas:netbackup:5.0:*:enterprise_server:*:*:*:*:*","matchCriteriaId":"E3592CA8-4F02-421D-B373-A859231A447E"},{"vulnerable":true,"criteria":"cpe:2.3:a:veritas:netbackup:5.0:*:server:*:*:*:*:*","matchCriteriaId":"790282C3-9148-4D78-95ED-058D2166EB92"},{"vulnerable":true,"criteria":"cpe:2.3:a:veritas:netbackup:5.1:*:enterprise_server:*:*:*:*:*","matchCriteriaId":"D6AD552C-8462-4B56-865C-7858A1892E58"},{"vulnerable":true,"criteria":"cpe:2.3:a:veritas:netbackup:5.1:*:server:*:*:*:*:*","matchCriteriaId":"F570650A-8E21-4F66-B4D2-447FBB8EA9D9"},{"vulnerable":true,"criteria":"cpe:2.3:a:veritas:netbackup:6.0:*:enterprise_server:*:*:*:*:*","matchCriteriaId":"BE706E94-7808-4C59-A17D-0E300D5E939D"},{"vulnerable":true,"criteria":"cpe:2.3:a:veritas:netbackup:6.0:*:server:*:*:*:*:*","matchCriteriaId":"2B52E958-2728-48C8-ACBC-CED68045A9FC"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"991","Ordinal":"1","Title":"CVE-2006-0991","CVE":"CVE-2006-0991","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"991","Ordinal":"1","NoteData":"Buffer overflow in the NetBackup Sharepoint Services server daemon (bpspsserver) on NetBackup 6.0 for Windows allows remote attackers to execute arbitrary code via crafted \"Request Service\" packets to the vnetd service (TCP port 13724).","Type":"Description","Title":"CVE-2006-0991"},{"CveYear":"2006","CveId":"991","Ordinal":"2","NoteData":"2006-03-27","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"991","Ordinal":"3","NoteData":"2018-10-18","Type":"Other","Title":"Modified"}]}}}