Vulnerability Note VU#650432
Symantec Veritas NetBackup bpcd.exe CONNECT_OPTIONS buffer overflow
Symantec Veritas NetBackup contains a buffer overflow vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Symantec VERITAS NetBackup is a client/server based backup software solution. The NetBackup bpcd daemon is vulnerable to a buffer overflow when handling CONNECT_OPTIONS requests to a NetBackup Master/Media Server. The bpcd daemon listens on 13782/tcp.
A remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system with the privileges of the bpcd daemon.
Apply an update
Symantec has released patches to correct this issue in Symantec Security Advisory SYM06-024. The updated versions are NetBackup Enterprise Server/NetBackup Server; Server and client and Storage Migrator versions 6.0_MP4, 5.1_MP6, and 5.0_MP7.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Symantec, Inc.||Affected||-||15 Dec 2006|
CVSS Metrics (Learn More)
This vulnerability was reported by TippingPoint ZDI, who in turn credit Sebastian Apelt.
This document was written by Will Dormann.
- CVE IDs: CVE-2006-5822
- Date Public: 14 Dec 2006
- Date First Published: 15 Dec 2006
- Date Last Updated: 12 Jan 2007
- Severity Metric: 11.25
- Document Revision: 4
If you have feedback, comments, or additional information about this vulnerability, please send us email.