PT-2006-5655 · Symantec Veritas · Netbackup

Published 2006-12-14 · Updated 2017-07-20 · CVE-2006-4902

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Veritas NetBackup versions 5.0 through 5.0 before MP7 Symantec Veritas NetBackup versions 5.1 through 5.1 before MP6 Symantec Veritas NetBackup versions 6.0 through 6.0 before MP4

Description The issue is related to the NetBackup bpcd daemon, which does not properly check for chained commands. This allows remote attackers to execute arbitrary commands by appending malicious commands to valid commands.

Recommendations For Symantec Veritas NetBackup versions 5.0 through 5.0 before MP7, update to version 5.0 MP7 or later. For Symantec Veritas NetBackup versions 5.1 through 5.1 before MP6, update to version 5.1 MP6 or later. For Symantec Veritas NetBackup versions 6.0 through 6.0 before MP4, update to version 6.0 MP4 or later.

Fix

Related Identifiers

CVE-2006-4902

Affected Products

Netbackup

References · 9

• http://symantec.com/avcenter/security/Content/2006.12.13a.html · Patch
• http://kb.cert.org/vuls/id/252936 · Patch
• http://secunia.com/advisories/23368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4902 · Security Note
• http://securityfocus.com/bid/21565 · Patch
• http://securitytracker.com/id?1017379 · Patch
• http://iss.net/threats/247.html · Note
• http://vupen.com/english/advisories/2006/4999 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27638 · Note