CVE-2005-2715
VERITAS NetBackup Remote Code Execution
Severity Score
9.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
4
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Format string vulnerability in the Java user interface service (bpjava-msvc) daemon for VERITAS NetBackup Data and Business Center 4.5FP and 4.5MP, and NetBackup Enterprise/Server/Client 5.0, 5.1, and 6.0, allows remote attackers to execute arbitrary code via the COMMAND_LOGON_TO_MSERVER command.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable NetBackup installations. Authentication is not required to exploit this vulnerability.
This specific flaw exists within the bpjava-msvc daemon due to incorrect handling of format string data passed through the 'COMMAND_LOGON_TO_MSERVER' command. The vulnerable daemon listens on TCP port 13722 and affects both NetBackup clients and servers.
*Credits:
This vulnerability was discovered by Kevin Finisterre with exploitation assistance from JohnH.
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2005-08-26 CVE Reserved
- 2005-10-12 CVE Published
- 2005-10-20 First Exploit
- 2024-08-07 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (11)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/1263 | 2005-10-20 | |
| https://www.exploit-db.com/exploits/1265 | 2005-10-20 | |
| https://www.exploit-db.com/exploits/1264 | 2005-10-20 | |
| http://www.securityfocus.com/bid/15079 | 2024-08-07 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/17181 | 2008-09-05 | |
| http://securitytracker.com/id?1015028 | 2008-09-05 | |
| http://seer.support.veritas.com/docs/279085.htm | 2008-09-05 | |
| http://sunsolve.sun.com/search/document.do?assetkey=1-26-102054-1 | 2008-09-05 | |
| http://www.kb.cert.org/vuls/id/495556 | 2008-09-05 | |
| http://www.symantec.com/avcenter/security/Content/2005.10.12.html | 2008-09-05 |
| URL | Date | SRC |
|---|---|---|
| http://www.zerodayinitiative.com/advisories/ZDI-05-001.html | 2008-09-05 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Symantec Veritas Search vendor "Symantec Veritas" | Netbackup Data And Business Center Search vendor "Symantec Veritas" for product "Netbackup Data And Business Center" | 4.5fp Search vendor "Symantec Veritas" for product "Netbackup Data And Business Center" and version "4.5fp" | - |
Affected
| ||||||
| Symantec Veritas Search vendor "Symantec Veritas" | Netbackup Data And Business Center Search vendor "Symantec Veritas" for product "Netbackup Data And Business Center" | 4.5mp Search vendor "Symantec Veritas" for product "Netbackup Data And Business Center" and version "4.5mp" | - |
Affected
| ||||||
| Symantec Veritas Search vendor "Symantec Veritas" | Netbackup Enterprise Server Client Search vendor "Symantec Veritas" for product "Netbackup Enterprise Server Client" | 5.0 Search vendor "Symantec Veritas" for product "Netbackup Enterprise Server Client" and version "5.0" | - |
Affected
| ||||||
| Symantec Veritas Search vendor "Symantec Veritas" | Netbackup Enterprise Server Client Search vendor "Symantec Veritas" for product "Netbackup Enterprise Server Client" | 5.1 Search vendor "Symantec Veritas" for product "Netbackup Enterprise Server Client" and version "5.1" | - |
Affected
| ||||||
| Symantec Veritas Search vendor "Symantec Veritas" | Netbackup Enterprise Server Client Search vendor "Symantec Veritas" for product "Netbackup Enterprise Server Client" | 6.0 Search vendor "Symantec Veritas" for product "Netbackup Enterprise Server Client" and version "6.0" | - |
Affected
| ||||||