Input validation error in NetBackup Appliance



| Updated: 2020-08-08
Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2017-8859
CWE-ID CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
 NetBackup Appliance
Client/Desktop applications / Multimedia software

Vendor Veritas Technologies

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Input validation error

EUVDB-ID: #VU39063

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-8859

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

In Veritas NetBackup Appliance 3.0 and earlier, unauthenticated users can execute arbitrary commands as root.

Mitigation

Install update from vendor's website.

Vulnerable software versions

NetBackup Appliance: 2.7.3 - 3.0

CPE2.3 External links

https://www.securityfocus.com/bid/98383
https://www.veritas.com/content/support/en_US/security/VTS17-005.html#Issue1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###