Veritas NetBackup Appliance CVE-2018-18652 Arbitrary Command Execution Vulnerability

Bugtraq ID:	105737
Class:	Input Validation Error
CVE:	CVE-2018-18652
Remote:	Yes
Local:	No
Published:	Oct 26 2018 12:00AM
Updated:	Oct 26 2018 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Veritas NetBackup Appliance 3.1.1 Veritas NetBackup Appliance 2.7.2 Veritas NetBackup Appliance 2.7.1 Veritas NetBackup Appliance 2.5.4 Veritas NetBackup Appliance 2.5 Veritas NetBackup Appliance 2.0 Veritas NetBackup Appliance 1.2 Veritas NetBackup Appliance 3.0 Veritas NetBackup Appliance 2.7 Veritas NetBackup Appliance 2.6.1.2 Veritas NetBackup Appliance 2.6.1.0 Veritas NetBackup Appliance 2.6.0.4 Veritas NetBackup Appliance 2.6.0.0
Not Vulnerable:	Veritas NetBackup Appliance 3.1.2

Veritas NetBackup Appliance CVE-2018-18652 Arbitrary Command Execution Vulnerability

Veritas NetBackup Appliance is prone to a remote arbitrary command-execution vulnerability because it fails to sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary commands in context of the affected application with root privileges.

Veritas NetBackup Appliance 3.1.1 and prior are vulnerable.

Veritas NetBackup Appliance CVE-2018-18652 Arbitrary Command Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Veritas NetBackup Appliance CVE-2018-18652 Arbitrary Command Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Veritas NetBackup Appliance CVE-2018-18652 Arbitrary Command Execution Vulnerability

References:

• Veritas Homepage (Veritas )
  
• Remote command execution vulnerability in NetBackup Appliance (Veritas)