CVE-2017-8857

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated file copy and arbitrary remote command execution using the 'bprd' process.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/98384Third Party Advisory, VDB Entry
https://www.veritas.com/content/support/en_US/security/VTS17-004.html#Issue2Vendor Advisory
http://www.securityfocus.com/bid/98384Third Party Advisory, VDB Entry
https://www.veritas.com/content/support/en_US/security/VTS17-004.html#Issue2Vendor Advisory

Timeline

Published: May 9, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-88589.8In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using th CVE-2017-88599.8In Veritas NetBackup Appliance 3.0 and earlier, unauthenticated users can execute arbitrary commands as root.CVE-2017-88606.5Information disclosure through directory listing on the Cohu 3960HD allows an attacker to view and download source code, log files, and othe CVE-2017-88619.8Missing authentication for the remote configuration port 1236/tcp on the Cohu 3960HD allows an attacker to change configuration parameters s CVE-2017-88629.8The webupgrade function on the Cohu 3960HD does not verify the firmware upgrade files or process, allowing an attacker to upload a specially CVE-2017-88637.5Information disclosure of .esp source code on the Cohu 3960 allows an attacker to view sensitive information such as application logic with CVE-2017-88649.8Client-side enforcement using JavaScript of server-side security options on the Cohu 3960HD allows an attacker to manipulate options sent to CVE-2017-88655.9Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay att CVE-2017-88665.9Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote at CVE-2017-88675.9Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 use AES-128 with ECB mode to encrypt voice traffic between the d CVE-2017-88687.5acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk m CVE-2017-88697.8Buffer overflow in MediaCoder 0.8.48.5888 allows remote attackers to execute arbitrary code via a crafted .m3u file.