CVE-2016-7399

Published: Jan 4, 2017Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.

Affected (12)

Products: Veritas: Netbackup Appliance Firmware

1 product

Netbackup Appliance Firmware

Configuration A

12 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Veritas Netbackup Appliance Firmware	Version 2.6.0.0
Veritas Netbackup Appliance Firmware	Version 2.6.0.1
Veritas Netbackup Appliance Firmware	Version 2.6.0.2
Veritas Netbackup Appliance Firmware	Version 2.6.0.3
Veritas Netbackup Appliance Firmware	Version 2.6.0.4
Veritas Netbackup Appliance Firmware	Version 2.6.1.0
Veritas Netbackup Appliance Firmware	Version 2.6.1.1
Veritas Netbackup Appliance Firmware	Version 2.6.1.2
Veritas Netbackup Appliance Firmware	Version 2.7.0.0
Veritas Netbackup Appliance Firmware	Version 2.7.1.0
Veritas Netbackup Appliance Firmware	Version 2.7.2.0
Veritas Netbackup Appliance Firmware	Version 3.0.0.0

Running on/with	Platform Versions
Veritas Netbackup Appliance	All versions

Related CWEs

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (10)

http://www.sec-1.com/blog/2016/veritas-netbackup-appliance-unauthenticated-remote-command-execution

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/94384

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037555

Source: cve@mitre.org

https://www.veritas.com/content/support/en_US/security/VTS16-002.html

Source: cve@mitre.org

Vendor Advisory

https://www.veritas.com/support/en_US/article.000116055

Source: cve@mitre.org

MitigationPatchVendor Advisory

http://www.sec-1.com/blog/2016/veritas-netbackup-appliance-unauthenticated-remote-command-execution

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/bid/94384

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037555

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.veritas.com/content/support/en_US/security/VTS16-002.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.veritas.com/support/en_US/article.000116055

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationPatchVendor Advisory

Timeline

No history available yet.