PT-2023-8787 · Veritas · Veritas Netbackup It Analytics

Published 2023-03-24 · Updated 2023-03-31 · CVE-2023-28818

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Veritas NetBackup IT Analytics versions prior to 11.2.0

Description The issue is related to errors in cryptographic signature verification, which could allow a remote attacker to compromise data integrity. A malicious actor could exploit the application upgrade process, which includes unsigned files, to install rogue Collector executable files, such as aptare.jar or upgrademanager.zip, on the Portal server. These files might then be downloaded and installed on collectors.

Recommendations For Veritas NetBackup IT Analytics versions prior to 11.2.0, update to version 11.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Portal server to minimize the risk of exploitation. Avoid using the unsigned files in the application upgrade process until the issue is resolved.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-494

CWE-347

Related Identifiers

BDU:2024-01905

CVE-2023-28818

Affected Products

Veritas Netbackup It Analytics

References · 7

• https://veritas.com/content/support/en_US/security/VTS23-002 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01905 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28818 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28818 · Vendor Advisory
• https://t.me/cvenotify/46793 · Telegram Post
• https://t.me/cibsecurity/60641 · Telegram Post
• https://t.me/cvenotify/47233 · Telegram Post