CVE-2016-7399
CriticalSummary
In Veritas NetBackup Appliance versions 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x, a vulnerability allows remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.
Risk Assessment
An attacker can exploit this vulnerability to execute code remotely, potentially leading to system compromise and exposure of sensitive data.
Recommendation
It is recommended to update Veritas NetBackup Appliance to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in Veritas NetBackup Appliance
See all- CVE-2017-8859Critical
In Veritas NetBackup Appliance version 3.0 and earlier, unauthenticated users can execute arbitrary commands as root.
- CVE-2023-37237Medium
In Veritas NetBackup Appliance before version 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH.
Original NVD description (English source)
scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.