Headline

CVE-2022-36992: VTS22-004: HotFix for Security Advisory impacting NetBackup – Primary/Media Server

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could remotely execute arbitrary commands on a NetBackup Primary server (in specific notify conditions).

2 years ago

CVE

Open in Source

#xss #vulnerability #windows #dos #perl #ssrf #buffer_overflow #auth

Revision History

1.0: July 18: Initial Release

Summary

Veritas has addressed multiple security vulnerabilities impacting Veritas NetBackup, NetBackup Appliance, Flex Appliance, and Flex Scale. If you are at an earlier release of NetBackup, you will need to first upgrade to a version where a HotFix is available and then apply the appropriate HotFix. Table 2 of this advisory lists the high-level description. Click the Description hyperlink in Table 2 for more detail on each vulnerability.

Affected products/versions:

NetBackup 8.1.x, 8.2, 8.3.x, 9.0.x, 9.1.x
NetBackup Appliance/NetBackup Virtual Appliance 3.1.x, 3.2, 3.2 MRs, 3.3.0.1, 3.3.0.x MRs, 4.0, 4.0.0.1 MRs, 4.1, 4.1.0.1 MRs
NetBackup 8.1.x, 8.2, 8.3.x, 9.0.x, 9.1.x Containers on Flex Appliance 1.3.x, 2.0, 2.0.x, 2.1
Flex Scale 1.3.1, 2.1

HotFixes are available for the following NetBackup versions:

NetBackup 8.1.2, 8.2, 8.3.0.1, 8.3.0.2, 9.0.0.1, 9.1.0.1

Remedial Actions:

Review Table 1 below to identify your current NetBackup Enterprise software version and follow the remediation steps to apply the HotFix, or upgrade to a version where a fix is available.
To fix ALL issues listed below we recommend applying the HotFix to Primary servers as well as all Media servers. This HotFix may be safely applied to all NetBackup Media servers.
Flex Appliance customers, please apply the NetBackup HotFix corresponding to the NetBackup Container version on Flex appliances.
Flex Scale Appliance customers, please contact Veritas Technical Support and reference Knowledge Article ID 100053006 to obtain a fix.

Table 1. Affected Version and Remedial Steps

NetBackup Version

NetBackup Appliance NetBackup Virtual Appliance

Remediation Steps

8.1.2

3.1.2

Apply VTS22-004 - Hotfix for Security Advisory impacting NetBackup 8.1.2 and Appliance 3.1.2 Master and Media Server

8.2

3.2, 3.2 MR1/MR2/MR3

Apply VTS22-004 - Hotfix for Security Advisory impacting NetBackup 8.2 and Appliance 3.2 Master and Media Server

8.3.0.1

3.3.0.1 MR1/MR2

Apply VTS22-004 - Hotfix for Security Advisory impacting NetBackup 8.3.0.1 and Appliance 3.3.0.1 Primary and Media Servers

8.3.0.2

3.3.0.2 MR1/MR2

Apply VTS22-004 - Hotfix for Security Advisory impacting NetBackup 8.3.0.2 and Appliance 3.3.0.2 Primary and Media Servers

9.0.0.1

4.0.0.1 MR1/MR2/MR3

Apply VTS22-004 - Hotfix for Security Advisory impacting NetBackup 9.0.0.1 and Appliance 4.0.0.1 Primary and Media Server

9.1.0.1

4.1.0.1 MR1/MR2

Apply VTS22-004 - Hotfix for Security Advisory impacting NetBackup 9.1.0.1 and Appliance 4.1.0.1 Primary and Media Server

Pre-8.1.2

Pre-3.1.2

Upgrade to a newer version and apply NetBackup Hotfix if applicable

8.3

Upgrade to a newer version and apply NetBackup Hotfix if applicable

8.3.0.1

3.3.0.1, 3.3.0.1 MR1/MR2/MR3

Upgrade to a newer version and apply NetBackup Hotfix if applicable

9.0

4.0

Upgrade to a newer version and apply NetBackup Hotfix if applicable

9.1

4.1

Upgrade to a newer version and apply NetBackup Hotfix if applicable

10.0

5.0

Not Impacted

Table 2. Security Issues and Affected Products

Issue #

Description

Severity

Affected products

Apply HotFix to:

Authenticated Conditional Remote Command Execution

Critical