CVE-2022-36956
📋 TL;DR
CVE-2022-36956 allows remote attackers with a valid NetBackup certificate/private key from the same domain to execute arbitrary commands on NetBackup Client systems. This affects Veritas NetBackup versions 9.0.x through 9.0.0.1 and 9.1.x through 9.1.0.1, enabling remote code execution.
💻 Affected Systems
- Veritas NetBackup
📦 What is this software?
Netbackup by Veritas
Netbackup by Veritas
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over NetBackup Client systems, potentially leading to data theft, ransomware deployment, or lateral movement across the network.
Likely Case
Unauthorized command execution leading to data exfiltration, privilege escalation, or deployment of malware on backup infrastructure.
If Mitigated
Limited impact if network segmentation restricts access to NetBackup Clients and certificate management is tightly controlled.
🎯 Exploit Status
Exploitation requires possession of valid NetBackup certificates, but once obtained, command execution is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0.0.2 and 9.1.0.2
Vendor Advisory: https://www.veritas.com/content/support/en_US/security/VTS22-008
Restart Required: Yes
Instructions:
1. Download patches from Veritas support portal. 2. Apply patch to all NetBackup Client systems. 3. Restart NetBackup services. 4. Verify patch installation.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to NetBackup Clients to only trusted management systems.
Certificate Management
allImplement strict certificate lifecycle management and regularly rotate NetBackup certificates.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate NetBackup Clients from untrusted networks.
- Enhance certificate management with regular rotation and monitoring for unauthorized certificate usage.
🔍 How to Verify
Check if Vulnerable:
Check NetBackup version using 'bpgetconfig' command and compare against affected versions.Check Version:
bpgetconfig | grep -i versionVerify Fix Applied:
Verify installed version is 9.0.0.2 or higher for 9.0.x, or 9.1.0.2 or higher for 9.1.x.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in NetBackup logs
- Unauthorized certificate usage attempts
- Suspicious network connections to NetBackup Client ports
Network Indicators:
- Unexpected traffic to NetBackup Client ports (typically 13724/tcp)
- Anomalous certificate-based authentication patterns
SIEM Query:
source="netbackup.log" AND ("command execution" OR "unauthorized access")