CVE-2022-36949
📋 TL;DR
CVE-2022-36949 is a local privilege escalation vulnerability in Veritas NetBackup OpsCenter. An attacker with local access to an OpsCenter server could potentially gain elevated privileges. This affects NetBackup OpsCenter versions 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and version 10.
💻 Affected Systems
- Veritas NetBackup OpsCenter
📦 What is this software?
Netbackup by Veritas
Netbackup by Veritas
Netbackup by Veritas
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access could gain administrative privileges on the OpsCenter server, potentially compromising the entire NetBackup environment and accessing sensitive backup data.
Likely Case
Malicious insiders or attackers who have gained initial foothold could escalate privileges to execute arbitrary commands, modify configurations, or access backup data.
If Mitigated
With proper access controls and network segmentation, impact is limited to the OpsCenter server itself rather than the entire backup infrastructure.
🎯 Exploit Status
Exploitation requires local access to the OpsCenter server. No public exploit code has been released.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply patches: 8.3.0.3, 9.0.0.2, 9.1.0.2, or later versions
Vendor Advisory: https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue5
Restart Required: Yes
Instructions:
1. Download the appropriate patch from Veritas Support. 2. Stop NetBackup OpsCenter services. 3. Apply the patch according to Veritas documentation. 4. Restart OpsCenter services. 5. Verify the patch was applied successfully.
🔧 Temporary Workarounds
Restrict Local Access
allLimit local access to OpsCenter servers to authorized administrators only
Implement Least Privilege
allEnsure users and service accounts have only necessary privileges on OpsCenter servers
🧯 If You Can't Patch
- Implement strict access controls to limit who can log into OpsCenter servers
- Monitor OpsCenter servers for suspicious local activity and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check NetBackup OpsCenter version via the OpsCenter web interface or by examining installed software versionCheck Version:
On Windows: Check Programs and Features. On Linux: rpm -qa | grep -i opscenter or dpkg -l | grep -i opscenterVerify Fix Applied:
Verify the installed version is 8.3.0.3, 9.0.0.2, 9.1.0.2 or later📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts
- Suspicious local user activity on OpsCenter servers
- Unexpected service account privilege changes
Network Indicators:
- Unusual authentication patterns to OpsCenter servers
- Anomalous administrative access patterns
SIEM Query:
source="opscenter*" AND (event_type="privilege_escalation" OR user="*" AND action="elevate*")