Veritas NetBackup and NetBackup Appliance Arbitrary Command Execution Vulnerability
BID:98384
Info
Veritas NetBackup and NetBackup Appliance Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 98384 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-8857 |
| Remote: | Yes |
| Local: | No |
| Published: | May 09 2017 12:00AM |
| Updated: | May 23 2017 04:24PM |
| Credit: | Sven Blumenstein and Xiaoran Wang from the Google Security Team |
| Vulnerable: |
Veritas NetBackup Appliance 2.7.3 Veritas NetBackup Appliance 2.7.2 Veritas NetBackup Appliance 2.7.1 Veritas NetBackup Appliance 2.5.4 Veritas NetBackup Appliance 2.5 Veritas NetBackup Appliance 2.0 Veritas NetBackup Appliance 1.2 Veritas NetBackup Appliance 1.1 Veritas NetBackup Appliance 3.0 Veritas NetBackup Appliance 2.7 Veritas NetBackup Appliance 2.6.1.2 Veritas NetBackup Appliance 2.6.1.0 Veritas NetBackup Appliance 2.6.0.4 Veritas NetBackup Appliance 2.6.0.0 Veritas NetBackup 7.7.2 Veritas NetBackup 7.7.1 Veritas NetBackup 7.7 Veritas NetBackup 7.5 Veritas NetBackup 7.1 Veritas NetBackup 8.0 Veritas NetBackup 7.6.1.2 Veritas NetBackup 7.6.1.0 Veritas NetBackup 7.6.0.4 Veritas NetBackup 7.6.0.0 Veritas NetBackup 7.5.0.7 Veritas NetBackup 7.0 |
| Not Vulnerable: | |
Discussion
Veritas NetBackup and NetBackup Appliance Arbitrary Command Execution Vulnerability
Veritas NetBackup and NetBackup Appliance are prone to remote arbitrary command-execution vulnerability because it fails to sanitize user-supplied input.
An attacker can exploit this issue to execute arbitrary commands within the context of the vulnerable application.
The following products are affected:
NetBackup 8.0 and prior.
NetBackup Appliance 3.0 and prior.
Veritas NetBackup and NetBackup Appliance are prone to remote arbitrary command-execution vulnerability because it fails to sanitize user-supplied input.
An attacker can exploit this issue to execute arbitrary commands within the context of the vulnerable application.
The following products are affected:
NetBackup 8.0 and prior.
NetBackup Appliance 3.0 and prior.
Exploit / POC
Veritas NetBackup and NetBackup Appliance Arbitrary Command Execution Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Veritas NetBackup and NetBackup Appliance Arbitrary Command Execution Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Veritas NetBackup and NetBackup Appliance Arbitrary Command Execution Vulnerability
References:
References:
- Veritas Homepage (Veritas Software)
- VTS17-004: Multiple Vulnerabilities in Veritas NetBackup and NetBackup Appliance (Veritas)