Veritas Bug ID: ET 4090775

Issue:  VTS22-015 - Security Advisory impacting NetBackup 8.3.0.1 and Appliance 3.3.0.1 Primary and Media Server

Version:  NetBackup 8.3.0.1/3.3.0.1

Problem Description:  VTS22-015 - Hotfix for Security Advisory impacting NetBackup 8.3.0.1 Appliance 3.3.0.1 Primary and Media Server

Problem Details and Fix:

The /usr/openv/java/auth.conf file grants access to functions in the NetBackup Administration Console. This file is created by default with only root having admin rights.  This file is present on Primary Servers, Media Servers and Clients.  Unless this file is modified to add non-root users to it to allow those users to manage Primary servers or a Media servers or Clients, the environment is NOT vulnerable, and the fix is not required.  
 
This applies to NetBackup Appliance, Flex appliance, and NetBackup Flex Scale as well if auth.conf is modified on those appliances/instances. Again, with the default non-modified auth.conf, the environment is NOT vulnerable. 

The fix updates the vulnerable bpjava binary on the machine the Java Admin UI console connects to.  

For more details about auth.conf please see: https://www.veritas.com/content/support/en_US/doc/21733320-149123528-0/v41641695-149123528 

Note this affects only Unix-based servers and clients. Windows-based servers and clients are unaffected.