CVE-2004-1389 Command injection in n/a
Attackers can execute arbitrary commands on Veritas NetBackup servers via the bpjava-susvc process, potentially compromising the backup infrastructure.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2004-1389?
CVE-2004-1389 is a medium-severity command injection vulnerability in Veritas Netbackup, published on 6 Feb 2005. It can be exploited over the network, with no action from the victim.
Official description
Unknown vulnerability in the Veritas NetBackup Administrative Assistant interface for NetBackup BusinesServer 3.4, 3.4.1, and 4.5, DataCenter 3.4, 3.4.1, and 4.5, Enterprise Server 5.1, and NetBackup Server 5.0 and 5.1, allows attackers to execute arbitrary commands via the bpjava-susvc process, possibly related to the call-back feature.
Which versions are affected by CVE-2004-1389?
It affects 1 product.
Products include Veritas Netbackup.
How do I fix CVE-2004-1389?
No fix has been published for CVE-2004-1389 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2004-1389 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-1389 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in Veritas Netbackup
Sources
Also known as GHSA-vg8m-xxh3-hmfr.