Sign-up

ID

VAR-201701-0411


CVE

CVE-2016-7399


TITLE

Veritas NetBackup Appliance scripts/license.pl Vulnerable to arbitrary command execution

Trust: 0.8

sources: JVNDB: JVNDB-2016-006619

DESCRIPTION

scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense. An attacker can exploit this issue to execute arbitrary commands in context of the affected application with root privileges. Symantec Veritas NetBackup (NBU) Appliance is an enterprise-level backup management appliance produced by Symantec Corporation of the United States. The scripts/license.pl file in Symantec Veritas NBU Appliance 2.6.x and 2.7.x has a security vulnerability

Trust: 1.98

sources: NVD: CVE-2016-7399 // JVNDB: JVNDB-2016-006619 // BID: 94384 // VULHUB: VHN-96219

AFFECTED PRODUCTS

vendor:veritasmodel:netbackup appliancescope:eqversion:2.6.1.2

Trust: 1.9

vendor:veritasmodel:netbackup appliancescope:eqversion:2.6.1.0

Trust: 1.9

vendor:veritasmodel:netbackup appliancescope:eqversion:2.6.0.4

Trust: 1.9

vendor:veritasmodel:netbackup appliancescope:eqversion:2.6.0.0

Trust: 1.9

vendor:veritasmodel:netbackup appliancescope:eqversion:3.0.0.0

Trust: 1.6

vendor:veritasmodel:netbackup appliancescope:eqversion:2.6.1.1

Trust: 1.6

vendor:veritasmodel:netbackup appliancescope:eqversion:2.7.2.0

Trust: 1.6

vendor:veritasmodel:netbackup appliancescope:eqversion:2.7.1.0

Trust: 1.6

vendor:veritasmodel:netbackup appliancescope:eqversion:2.7.0.0

Trust: 1.6

vendor:veritasmodel:netbackup appliancescope:eqversion:2.6.0.1

Trust: 1.6

vendor:veritasmodel:netbackup appliancescope:eqversion:2.6.0.2

Trust: 1.0

vendor:veritasmodel:netbackup appliancescope:eqversion:2.6.0.3

Trust: 1.0

vendor:veritasmodel:netbackup the appliancescope: - version: -

Trust: 0.8

vendor:veritasmodel:netbackup the appliancescope:eqversion:2.6.0.4 for up to 2.6.0.x

Trust: 0.8

vendor:veritasmodel:netbackup the appliancescope:eqversion:2.6.1.2 for up to 2.6.1.x

Trust: 0.8

vendor:veritasmodel:netbackup the appliancescope:eqversion:2.7.3 for up to 2.7.x

Trust: 0.8

vendor:veritasmodel:netbackup the appliancescope:eqversion:3.0.x

Trust: 0.8

vendor:veritasmodel:netbackup appliancescope:eqversion:2.7.2

Trust: 0.3

vendor:veritasmodel:netbackup appliancescope:eqversion:2.7.1

Trust: 0.3

sources: BID: 94384 // JVNDB: JVNDB-2016-006619 // CNNVD: CNNVD-201611-551 // NVD: CVE-2016-7399

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-7399
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-7399
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201611-551
value: CRITICAL

Trust: 0.6

VULHUB: VHN-96219
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-7399
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-96219
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-7399
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-96219 // JVNDB: JVNDB-2016-006619 // CNNVD: CNNVD-201611-551 // NVD: CVE-2016-7399

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.9

sources: VULHUB: VHN-96219 // JVNDB: JVNDB-2016-006619 // NVD: CVE-2016-7399

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201611-551

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201611-551

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-006619

PATCH
title:VTS16-002: NetBackup Appliance Arbitrary Command Execution Vulnerabilityurl:https://www.veritas.com/content/support/en_US/security/VTS16-002.html
Trust: 0.8
title:Article:000116055url:https://www.veritas.com/support/en_US/article.000116055
Trust: 0.8
title:Symantec Veritas NetBackup Appliance Fixes for arbitrary command execution vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65881
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-006619 // 
            
            
            
            CNNVD: CNNVD-201611-551

EXTERNAL IDS
db:NVDid:CVE-2016-7399
Trust: 2.8
db:BIDid:94384
Trust: 2.0
db:SECTRACKid:1037555
Trust: 1.1
db:JVNDBid:JVNDB-2016-006619
Trust: 0.8
db:CNNVDid:CNNVD-201611-551
Trust: 0.7
db:VULHUBid:VHN-96219
Trust: 0.1
sources:
            
            
            VULHUB: VHN-96219 // 
            
            
            
            BID: 94384 // 
            
            
            
            JVNDB: JVNDB-2016-006619 // 
            
            
            
            CNNVD: CNNVD-201611-551 // 
            
            
            
            NVD: CVE-2016-7399

REFERENCES
url:http://www.securityfocus.com/bid/94384
Trust: 2.3
url:https://www.veritas.com/content/support/en_us/security/vts16-002.html
Trust: 2.0
url:http://www.sec-1.com/blog/2016/veritas-netbackup-appliance-unauthenticated-remote-command-execution
Trust: 2.0
url:https://www.veritas.com/support/en_us/article.000116055
Trust: 1.7
url:http://www.securitytracker.com/id/1037555
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-7399
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-7399
Trust: 0.8
url:https://www.veritas.com/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-96219 // 
            
            
            
            BID: 94384 // 
            
            
            
            JVNDB: JVNDB-2016-006619 // 
            
            
            
            CNNVD: CNNVD-201611-551 // 
            
            
            
            NVD: CVE-2016-7399

CREDITS
Matthew Hall.
Trust: 0.9
sources:
            
            
            BID: 94384 // 
            
            
            
            CNNVD: CNNVD-201611-551

SOURCES
db:VULHUBid:VHN-96219
db:BIDid:94384
db:JVNDBid:JVNDB-2016-006619
db:CNNVDid:CNNVD-201611-551
db:NVDid:CVE-2016-7399

LAST UPDATE DATE
2025-04-13T23:38:58.328000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-96219date:2017-07-27T00:00:00
db:BIDid:94384date:2016-11-24T01:11:00
db:JVNDBid:JVNDB-2016-006619date:2017-01-16T00:00:00
db:CNNVDid:CNNVD-201611-551date:2017-01-05T00:00:00
db:NVDid:CVE-2016-7399date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-96219date:2017-01-04T00:00:00
db:BIDid:94384date:2016-11-17T00:00:00
db:JVNDBid:JVNDB-2016-006619date:2017-01-16T00:00:00
db:CNNVDid:CNNVD-201611-551date:2016-11-25T00:00:00
db:NVDid:CVE-2016-7399date:2017-01-04T21:59:00.167