CVE-2015-6550
CriticalSummary
The bpcd in Veritas NetBackup versions 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2, as well as in NetBackup Appliance versions 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2, allows remote attackers to execute arbitrary commands via crafted input.
Risk Assessment
Attackers can exploit this vulnerability to execute remote code, potentially leading to system takeover and compromising organizational data.
Recommendation
It is recommended to upgrade to the latest version of Veritas NetBackup and NetBackup Appliance to mitigate this vulnerability.
Other vulnerabilities in Veritas NetBackup, NetBackup Appliance
See all- CVE-2017-6401High
An issue was discovered in Veritas NetBackup before version 8.0 and NetBackup Appliance before version 3.0 that allows local arbitrary command execution. The use of bpcd and bpnbat can lead to such an attack.
- CVE-2017-6399High
An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2 that allows privileged remote command execution on NetBackup Server and Client.
- CVE-2017-6403Critical
An issue was discovered in Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0 related to the use of hardcoded username and password in the NetBackup Cloud Storage Service.
- CVE-2015-6552Critical
The management-services protocol implementation in Veritas NetBackup versions 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2, as well as in NetBackup Appliance versions 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to make arbitrary RPC calls via unspecified vectors.
Original NVD description (English source)
bpcd in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary commands via crafted input.