Revisions

1.0: October 26, 2018: Initial release

Summary

Use-after-free vulnerability in Veritas Backup Exec agents can lead to a denial of service or remote code execution.

Issue Description Severity Fixed Version

1

Remote command execution vulnerability in NetBackup Appliance

High

NetBackup Appliance 3.1.2

 

Issues

Issue #1

Remote command execution vulnerability in Veritas NetBackup Appliance that allows authenticated administrators to execute arbitrary commands as root. This issue was caused by insufficient filtering of user provided input.

CVE ID: CVE-2018-18652
Severity: High
CVSS v3 Base Score: 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Important points:

  • A malicious administrator could use this vulnerability to delete or modify backed up data without that change being detected, or for other purposes, e.g. to install malware on the appliance.
  • This vulnerability only affects administrator accounts on the appliance, it does not affect user accounts.
  • This vulnerability only affects the NetBackup Appliance, it does not affect NetBackup.

Affected Products

  • NetBackup Appliance 3.1.1 and earlier

 

Questions

If you have any questions about any information in this security advisory please contact Veritas technical support.

 

Best Practices

As part of normal best practices, Veritas recommends that customers:

  • Restrict access of administration or management systems to privileged users.
  • Restrict remote access, if required, to trusted/authorized systems only.
  • Keep all operating systems and applications updated with the latest vendor patches.
  • Follow a multi-layered approach to security. Run both firewall and anti-malware applications, at a minimum, to provide multiple points of detection and protection to both inbound and outbound threats.
  • Deploy network and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in detection of attacks or malicious activity related to exploitation of latent vulnerabilities

 

Disclaimer

THE SECURITY ADVISORY IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. Veritas Technologies LLC SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.

Veritas Technologies LLC
500 East Middlefield Road
Mountain View, CA 94043

http://www.veritas.com/

 

© 2017 Veritas Technologies LLC. All rights reserved. Veritas, the Veritas Logo, and NetBackup are trademarks or registered trademarks of Veritas Technologies LLC or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.