CVE-2016-7399

Опубликовано: 04 янв. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Средний

Описание

scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.

Ссылки

http://www.sec-1.com/blog/2016/veritas-netbackup-appliance-unauthenticated-remote-command-execution
Third Party Advisory
http://www.securityfocus.com/bid/94384
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037555
https://www.veritas.com/content/support/en_US/security/VTS16-002.html
Vendor Advisory
https://www.veritas.com/support/en_US/article.000116055
Mitigation
Patch
Vendor Advisory
http://www.sec-1.com/blog/2016/veritas-netbackup-appliance-unauthenticated-remote-command-execution
Third Party Advisory
http://www.securityfocus.com/bid/94384
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037555
https://www.veritas.com/content/support/en_US/security/VTS16-002.html
Vendor Advisory
https://www.veritas.com/support/en_US/article.000116055
Mitigation
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:veritas:netbackup_appliance_firmware:2.6.0.0:*:*:*:*:*:*:*

cpe:2.3:o:veritas:netbackup_appliance_firmware:2.6.0.1:*:*:*:*:*:*:*

cpe:2.3:o:veritas:netbackup_appliance_firmware:2.6.0.2:*:*:*:*:*:*:*

cpe:2.3:o:veritas:netbackup_appliance_firmware:2.6.0.3:*:*:*:*:*:*:*

cpe:2.3:o:veritas:netbackup_appliance_firmware:2.6.0.4:*:*:*:*:*:*:*

cpe:2.3:o:veritas:netbackup_appliance_firmware:2.6.1.0:*:*:*:*:*:*:*

cpe:2.3:o:veritas:netbackup_appliance_firmware:2.6.1.1:*:*:*:*:*:*:*

cpe:2.3:o:veritas:netbackup_appliance_firmware:2.6.1.2:*:*:*:*:*:*:*

cpe:2.3:o:veritas:netbackup_appliance_firmware:2.7.0.0:*:*:*:*:*:*:*

cpe:2.3:o:veritas:netbackup_appliance_firmware:2.7.1.0:*:*:*:*:*:*:*

cpe:2.3:o:veritas:netbackup_appliance_firmware:2.7.2.0:*:*:*:*:*:*:*

cpe:2.3:o:veritas:netbackup_appliance_firmware:3.0.0.0:*:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_appliance:-:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.13393

Средний

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-77

Связанные уязвимости

GHSA-3mcq-hx52-4939

CVSS3: 9.8

github

больше 3 лет назад

BDU:2017-02622

CVSS3: 9.8

fstec

больше 9 лет назад

Уязвимость сценария «scripts/license.pl» средства резервного копирования Veritas NetBackup Appliance, позволяющая нарушителю выполнить произвольные команды

EPSS

Процентиль: 94%

0.13393

Средний

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-77