CVE-2016-7399 scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to execute arbitrary commands via shell metach...
CriticalCVSS 9.8
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| veritas netbackup appliance firmware | = 2.6.0.0 | No fix listed |
| veritas netbackup appliance firmware | = 2.6.0.1 | No fix listed |
| veritas netbackup appliance firmware | = 2.6.0.2 | No fix listed |
| veritas netbackup appliance firmware | = 2.6.0.3 | No fix listed |
| veritas netbackup appliance firmware | = 2.6.0.4 | No fix listed |
| veritas netbackup appliance firmware | = 2.6.1.0 | No fix listed |
| veritas netbackup appliance firmware | = 2.6.1.1 | No fix listed |
| veritas netbackup appliance firmware | = 2.6.1.2 | No fix listed |
| veritas netbackup appliance firmware | = 2.7.0.0 | No fix listed |
| veritas netbackup appliance firmware | = 2.7.1.0 | No fix listed |
| veritas netbackup appliance firmware | = 2.7.2.0 | No fix listed |
| veritas netbackup appliance firmware | = 3.0.0.0 | No fix listed |
References
- www.sec-1.com third-party-advisory
- 94384 third-party-advisory vdb-entry
- 1037555 vdb-entry
- www.veritas.com vendor-advisory
- www.veritas.com mitigation patch vendor-advisory