Symantec Veritas NetBackup contains a buffer overflow vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Symantec VERITAS NetBackup is a client/server based backup software solution. The NetBackup bpcd daemon is vulnerable to a buffer overflow when handling CONNECT_OPTIONS requests to a NetBackup Master/Media Server. The bpcd daemon listens on 13782/tcp.
A remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system with the privileges of the bpcd daemon.
Apply an update
Symantec has released patches to correct this issue in Symantec Security Advisory SYM06-024. The updated versions are NetBackup Enterprise Server/NetBackup Server; Server and client and Storage Migrator versions 6.0_MP4, 5.1_MP6, and 5.0_MP7.
This vulnerability was reported by TippingPoint ZDI, who in turn credit Sebastian Apelt.
This document was written by Will Dormann.
|Date First Published:||2006-12-15|
|Date Last Updated:||2007-01-12 21:23 UTC|