• Product Information
• Security Products Overview
• Juniper Networks ISG Series
• IDP Demo
• Product Poster & Z-Card 

Title: VERITAS NetBackup Java User-Interface Remote Format String Vulnerability

Severity: CRITICAL

Description:

Veritas NetBackup is a network-enabled backup solution that is available for various platforms.

NetBackup Java user interface (UI) is affected by a remote format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Specifically, the Java UI authentication service 'bpjava-msvc' listening on port 13722, which runs on Veritas NetBackup servers and agents, is vulnerable to this issue. This vulnerability resides in the 'COMMAND_LOGON_TO_MSERVER' command.

An attacker can exploit this vulnerability by crafting a malicious request that contains format specifiers. A successful attack may crash the server or lead to arbitrary code execution. This may facilitate unauthorized access or privilege escalation with SYSTEM or superuser privileges.

Note that NetBackup 4.5 Maintenance Pack and NetBackup BusinesServer 4.5 Maintenance Pack running on Microsoft Windows 32-bit platforms or Windows 64-bit platforms are not affected by this issue. NetBackup 4.5 Feature Pack and NetBackup BusinesServer 4.5 Feature Pack running on Windows 64-bit platforms are immune as well.

NetBackup 3.4 and 5.0 running on Windows 64-bit platforms are also not affected.

Affected Products:

• Veritas Software NetBackup Advanced Reporter 4.5.0
• Veritas Software NetBackup Advanced Reporter 4.5.0 FP1
• Veritas Software NetBackup Advanced Reporter 4.5.0 FP2
• Veritas Software NetBackup Advanced Reporter 4.5.0 FP3
• Veritas Software NetBackup Advanced Reporter 4.5.0 FP4
• Veritas Software NetBackup Advanced Reporter 4.5.0 MP1
• Veritas Software NetBackup Advanced Reporter 4.5.0 MP2
• Veritas Software NetBackup Advanced Reporter 4.5.0 MP3
• Veritas Software NetBackup Advanced Reporter 4.5.0 MP4
• Veritas Software NetBackup BusinesServer 3.4.0
• Veritas Software NetBackup BusinesServer 4.5.0
• Veritas Software NetBackup BusinesServer 4.5.0 FP
• Veritas Software NetBackup BusinesServer 4.5.0 MP
• Veritas Software NetBackup Client 5.0.0
• Veritas Software NetBackup Client 5.1.0
• Veritas Software NetBackup Client 6.0.0
• Veritas Software NetBackup DataCenter 3.4.0
• Veritas Software NetBackup DataCenter 4.5.0
• Veritas Software NetBackup DataCenter 4.5.0 FP
• Veritas Software NetBackup DataCenter 4.5.0 MP
• Veritas Software NetBackup DataCenter 5.0.0
• Veritas Software NetBackup Enterprise Server 5.0.0
• Veritas Software NetBackup Enterprise Server 5.1.0
• Veritas Software NetBackup Enterprise Server 6.0.0
• Veritas Software NetBackup Global Data Manager 4.5.0
• Veritas Software NetBackup Global Data Manager 4.5.0 FP1
• Veritas Software NetBackup Global Data Manager 4.5.0 FP2
• Veritas Software NetBackup Global Data Manager 4.5.0 FP3
• Veritas Software NetBackup Global Data Manager 4.5.0 FP4
• Veritas Software NetBackup Global Data Manager 4.5.0 MP1
• Veritas Software NetBackup Global Data Manager 4.5.0 MP2
• Veritas Software NetBackup Global Data Manager 4.5.0 MP3
• Veritas Software NetBackup Global Data Manager 4.5.0 MP4
• Veritas Software NetBackup Global Data Manager 5.0.0
• Veritas Software NetBackup Server 3.4.0
• Veritas Software NetBackup Server 5.0.0
• Veritas Software NetBackup Server 5.0.0
• Veritas Software NetBackup Server 5.1.0
• Veritas Software NetBackup Server 5.1.0
• Veritas Software NetBackup Server 6.0.0
• Veritas Software NetBackup for NetWare Media Servers 4.5.0
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 FP1
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 FP2
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 FP3
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 FP4
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 FP5
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 FP6
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 FP7
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 FP8
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 MP1
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 MP2
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 MP3
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 MP4
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 MP5
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 MP6
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 MP7
• Veritas Software NetBackup for NetWare Media Servers 4.5.0 MP8
• Veritas Software NetBackup for NetWare Media Servers 5.0.0
• Veritas Software NetBackup for NetWare Media Servers 5.0.0 MP1
• Veritas Software NetBackup for NetWare Media Servers 5.0.0 MP2
• Veritas Software NetBackup for NetWare Media Servers 5.0.0 MP3
• Veritas Software NetBackup for NetWare Media Servers 5.0.0 MP4
• Veritas Software NetBackup for NetWare Media Servers 5.0.0 MP5
• Veritas Software NetBackup for NetWare Media Servers 5.1.0
• Veritas Software NetBackup for NetWare Media Servers 5.1.0 MP1
• Veritas Software NetBackup for NetWare Media Servers 5.1.0 MP2
• Veritas Software NetBackup for NetWare Media Servers 5.1.0 MP3

References:

• Symantec: SYM05-018 VERITAS NetBackup: Java User-Interface, format string vulnerability
• Veritas Software: Document ID: 279085

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.