HotFix for Security Advisory Impacting NetBackup Client

Revision History

• 1.0: July 18, 2022: Initial Release

Summary

Veritas has addressed two vulnerabilities affecting NetBackup Clients.

Issues

Issue #1: Arbitrary Command Execution

The NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain.

• CVE ID: CVE-2022-36956
• Severity: Critical
• CVSS v3.1 Base Score: 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
• Affected Versions: 9.0.x, 9.1.x
• Recommended action:
  • Upgrade NBU Client to 10.0 – no HotFix needed, or
  • Upgrade NBU Client to 9.1.0.1 and apply VTS22-008 - HotFix for Security Advisory impacting NetBackup 9.1.0.1 Clients (Etrack 4066508), or
  • Or upgrade NBU Client to 9.0.0.1 and apply VTS22-008 - HotFix for Security Advisory impacting NetBackup 9.0.0.1 Clients (Etrack 4067247), or
  • For NBU Client versions 8.3.x and earlier – Not Vulnerable - Not Applicable
    

Issue #2: Escalation of Privileges

An attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileges.

• CVE ID: CVE-2022-36955
• Severity: High
• CVSS v3.1 Base Score: 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
• Affected Versions: 9.1.x, 9.0.x, 8.3.x, 8.2 and earlier
• Recommended Actions:
  • Upgrade NBU Client to 10.0 – no HotFix needed, or
  • Upgrade NBU Client to 9.1.0.1 and apply VTS22-008 - HotFix for Security Advisory impacting NetBackup 9.1.0.1 Clients (Etrack 4066508), or
  • Upgrade NBU Client to 9.0.0.1 and apply VTS22-008 - HotFix for Security Advisory impacting NetBackup 9.0.0.1 Clients (Etrack 4067247), or
  • Upgrade NBU Client to 8.3.0.2 and apply VTS22-008 - HotFix Security Advisory impacting NetBackup 8.3.0.2 Clients (Etrack 4066512), or
  • For NBU Client version 8.2 apply VTS22-008 - Hotfix for Security Advisory impacting NetBackup 8.2 Clients (Etrack 4068828)
  • For NBU Client version 8.1.2 apply VTS22-008 - Hotfix for Security Advisory impacting NetBackup 8.1.2 Clients (Etrack-4071637)

Notes

Related Primary and Media Server fixes for these vulnerabilities have already been addressed in Security Advisory portion for VTS22-004.

Acknowledgement

Veritas would like to thank the following Airbus Security Team members for notifying us about Issue #2: Mouad Abouhali, Benoit Camredon, Nicholas Devillers, Anais Gantet, and Jean-Romain Garnier.

Questions

For questions or problems regarding this vulnerability please contact Veritas Technical Support (https://www.veritas.com/support)

Disclaimer

THE SECURITY ADVISORY IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. VERITAS TECHNOLOGIES LLC SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.

Veritas Technologies LLC 2625

Augustine Drive

Santa Clara, CA 95054