#VU39063 Input validation error in NetBackup Appliance - CVE-2017-8859

Vulnerability identifier: #VU39063

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-8859

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
NetBackup Appliance
Client/Desktop applications / Multimedia software

Vendor: Veritas Technologies

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

In Veritas NetBackup Appliance 3.0 and earlier, unauthenticated users can execute arbitrary commands as root.

Mitigation
Install update from vendor's website.

Vulnerable software versions

NetBackup Appliance: 2.7.3 - 3.0

---

External links
https://www.securityfocus.com/bid/98383
https://www.veritas.com/content/support/en_US/security/VTS17-005.html#Issue1

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.