CVE-2016-7399

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.sec-1.com/blog/2016/veritas-netbackup-appliance-unauthenticated-remote-command-executionThird Party Advisory
http://www.securityfocus.com/bid/94384Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037555
https://www.veritas.com/content/support/en_US/security/VTS16-002.htmlVendor Advisory
https://www.veritas.com/support/en_US/article.000116055Mitigation, Patch, Vendor Advisory
http://www.sec-1.com/blog/2016/veritas-netbackup-appliance-unauthenticated-remote-command-executionThird Party Advisory
http://www.securityfocus.com/bid/94384Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037555
https://www.veritas.com/content/support/en_US/security/VTS16-002.htmlVendor Advisory
https://www.veritas.com/support/en_US/article.000116055Mitigation, Patch, Vendor Advisory

Timeline

Published: Jan 4, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-74009.8Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id CVE-2016-74017.5The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers CVE-2016-74029.8SAP ASE 16.0 SP02 PL03 and prior versions allow attackers who own SourceDB and TargetDB databases to elevate privileges to sa (system admini CVE-2016-74049.8OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving CVE-2016-74059.8The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injectio CVE-2016-74069.8Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in CVE-2016-74079.8The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file.CVE-2016-74088.8The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.CVE-2016-74095.5The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v CVE-2016-74105.5The _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to cause a denial of service (buffer over-read) vi CVE-2016-74119.8ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a d CVE-2016-74128.1ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, w