CVE-2017-17418 : Security Advisory and Response

A vulnerability in Quest NetVault Backup 11.3.0.12 allows attackers to execute unauthorized code without authentication.

Understanding CVE-2017-17418

This CVE involves a flaw in how NVBUPolicy Get method requests are handled, enabling SQL injection attacks.

What is CVE-2017-17418?

The vulnerability in Quest NetVault Backup 11.3.0.12 permits attackers to execute code within the underlying database environment without needing authentication.

The Impact of CVE-2017-17418

Attackers can run unauthorized code on affected installations
Exploitation does not require authentication
Vulnerability arises from improper validation of user-provided strings

Technical Details of CVE-2017-17418

The following are technical details of the CVE-2017-17418 vulnerability:

Vulnerability Description

Allows remote attackers to execute arbitrary code
Lack of proper validation of user-supplied strings
Code execution in the context of the underlying database

Affected Systems and Versions

Product: Quest NetVault Backup
Vendor: Quest
Version: 11.3.0.12

Exploitation Mechanism

Attackers exploit the handling of NVBUPolicy Get method requests
Vulnerability stems from improper validation of user-supplied strings

Mitigation and Prevention

Protect your systems from CVE-2017-17418 with the following measures:

Immediate Steps to Take

Apply vendor-supplied patches promptly
Monitor for any unauthorized access or unusual activities

Long-Term Security Practices

Regularly update and patch software to address vulnerabilities
Implement proper input validation to prevent SQL injection attacks

Patching and Updates

Stay informed about security updates from Quest
Apply patches and updates as soon as they are available