CVE-2022-36998

Published: Jul 28, 2022Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could remotely trigger a stack-based buffer overflow on the NetBackup Primary server, resulting in a denial of service.

Affected (35)

Products: Veritas: Flex Appliance, Flex Scale, Netbackup, Netbackup Appliance

4 products

Configuration A

35 vulnerable

Vulnerable Software	Affected Versions
Veritas Flex Appliance	Version 1.2
Veritas Flex Appliance	Version 1.3
Veritas Flex Appliance	Version 2.0.1
Veritas Flex Appliance	Version 2.0.2
Veritas Flex Appliance	Version 2.0
Veritas Flex Appliance	Version 2.1
Veritas Flex Scale	Version 1.3.1
Veritas Flex Scale	Version 2.1
Veritas Netbackup	Version 8.1.1
Veritas Netbackup	Version 8.1.2
Veritas Netbackup	Version 8.2
Veritas Netbackup	Version 8.3.0.1
Veritas Netbackup	Version 8.3.0.2
Veritas Netbackup	Version 8.3
Veritas Netbackup	Version 9.0.0.1
Veritas Netbackup	Version 9.0
Veritas Netbackup	Version 9.1.0.1
Veritas Netbackup	Version 9.1
Veritas Netbackup Appliance	Version 3.1.1
Veritas Netbackup Appliance	Version 3.1.2
Veritas Netbackup Appliance	Version 3.2
Veritas Netbackup Appliance	Version 4.0
Veritas Netbackup Appliance	Version 4.1
Veritas Netbackup Appliance	Version 3.2 maintenance_release1
Veritas Netbackup Appliance	Version 3.2 maintenance_release2
Veritas Netbackup Appliance	Version 3.2 maintenance_release3
Veritas Netbackup Appliance	Version 3.3.0.1 maintenance_release1
Veritas Netbackup Appliance	Version 3.3.0.1 maintenance_release2
Veritas Netbackup Appliance	Version 3.3.0.2 maintenance_release1
Veritas Netbackup Appliance	Version 3.3.0.2 maintenance_release2
Veritas Netbackup Appliance	Version 4.0.0.1 maintenance_release1
Veritas Netbackup Appliance	Version 4.0.0.1 maintenance_release2
Veritas Netbackup Appliance	Version 4.0.0.1 maintenance_release3
Veritas Netbackup Appliance	Version 4.1.0.1 maintenance_release1
Veritas Netbackup Appliance	Version 4.1.0.1 maintenance_release2

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

https://www.veritas.com/content/support/en_US/security/VTS22-004#m3

Source: cve@mitre.org

PatchVendor Advisory

https://www.veritas.com/content/support/en_US/security/VTS22-004#m3

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.