#VU42952 Path traversal in NetBackup Appliance - CVE-2013-1608

Vulnerability identifier: #VU42952

Vulnerability risk: Medium

CVSSv4.0: 4.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-1608

CWE-ID: CWE-22

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
NetBackup Appliance
Client/Desktop applications / Multimedia software

Vendor: Veritas Technologies

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the Management Console on the Symantec NetBackup (NBU) appliance 2.0.x. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to read arbitrary files via unspecified vectors.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

NetBackup Appliance: 2.0.0

---

External links
https://www.securityfocus.com/bid/58542
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130320_00

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.