CVE-2015-6552
CriticalSummary
The management-services protocol implementation in Veritas NetBackup versions 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2, as well as in NetBackup Appliance versions 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to make arbitrary RPC calls via unspecified vectors.
Risk Assessment
Attackers may exploit this vulnerability to perform unauthorized remote operations, potentially leading to serious security breaches in the system.
Recommendation
It is recommended to update to the latest version of Veritas NetBackup and NetBackup Appliance to mitigate this vulnerability.
Other vulnerabilities in Veritas NetBackup, NetBackup Appliance
See all- CVE-2017-6401High
An issue was discovered in Veritas NetBackup before version 8.0 and NetBackup Appliance before version 3.0 that allows local arbitrary command execution. The use of bpcd and bpnbat can lead to such an attack.
- CVE-2017-6399High
An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2 that allows privileged remote command execution on NetBackup Server and Client.
- CVE-2017-6403Critical
An issue was discovered in Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0 related to the use of hardcoded username and password in the NetBackup Cloud Storage Service.
- CVE-2015-6550Critical
The bpcd in Veritas NetBackup versions 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2, as well as in NetBackup Appliance versions 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2, allows remote attackers to execute arbitrary commands via crafted input.
Original NVD description (English source)
The management-services protocol implementation in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to make arbitrary RPC calls via unspecified vectors.