Veritas NetBackup Appliance CVE-2017-8859 Arbitrary Command Execution Vulnerability

Bugtraq ID:	98383
Class:	Input Validation Error
CVE:	CVE-2017-8859
Remote:	Yes
Local:	No
Published:	May 10 2017 12:00AM
Updated:	May 23 2017 04:24PM
Credit:	Matt Johnson of Morgan Stanley
Vulnerable:	Veritas NetBackup Appliance 2.7.3 Veritas NetBackup Appliance 2.7.2 Veritas NetBackup Appliance 2.7.1 Veritas NetBackup Appliance 3.0 Veritas NetBackup Appliance 2.6.1.2 Veritas NetBackup Appliance 2.6.1.0 Veritas NetBackup Appliance 2.6.0.4 Veritas NetBackup Appliance 2.6.0.0
Not Vulnerable:

Veritas NetBackup Appliance CVE-2017-8859 Arbitrary Command Execution Vulnerability

Veritas NetBackup Appliance is prone to a remote arbitrary command-execution vulnerability because it fails to sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary commands in context of the affected application with root privileges.

Veritas NetBackup Appliance 3.0, 2.7.3 and 2.7.2 and prior are vulnerable.

Veritas NetBackup Appliance CVE-2017-8859 Arbitrary Command Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Veritas NetBackup Appliance CVE-2017-8859 Arbitrary Command Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Veritas NetBackup Appliance CVE-2017-8859 Arbitrary Command Execution Vulnerability

References:

• Veritas Homepage (Veritas )
  
• VTS17-005: Remote Command Execution Vulnerability in Veritas NetBackup Appliance (veritas)