CVE-2017-6403 : Security Advisory and Response

A vulnerability was detected in Veritas NetBackup versions prior to 8.0 and NetBackup Appliance versions prior to 3.0. The NetBackup Cloud Storage Service was found to have a hardcoded username and password.

Understanding CVE-2017-6403

This CVE identifies a security issue in Veritas NetBackup and NetBackup Appliance versions.

What is CVE-2017-6403?

CVE-2017-6403 is a vulnerability in Veritas NetBackup and NetBackup Appliance versions that allows unauthorized access due to a hardcoded username and password in the NetBackup Cloud Storage Service.

The Impact of CVE-2017-6403

The presence of a hardcoded username and password in the NetBackup Cloud Storage Service could lead to unauthorized access to sensitive data and compromise the security of the affected systems.

Technical Details of CVE-2017-6403

This section provides technical details about the vulnerability.

Vulnerability Description

An issue was discovered in Veritas NetBackup versions before 8.0 and NetBackup Appliance versions before 3.0, where the NetBackup Cloud Storage Service uses a hardcoded username and password.

Affected Systems and Versions

Veritas NetBackup versions prior to 8.0
NetBackup Appliance versions prior to 3.0

Exploitation Mechanism

The vulnerability can be exploited by attackers who can leverage the hardcoded credentials to gain unauthorized access to the NetBackup Cloud Storage Service.

Mitigation and Prevention

Protecting systems from CVE-2017-6403 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update to the latest version of Veritas NetBackup and NetBackup Appliance that address the hardcoded credentials issue.
Implement strong, unique passwords for all services to prevent unauthorized access.

Long-Term Security Practices

Regularly monitor and audit access to the NetBackup Cloud Storage Service.
Conduct security training for personnel to raise awareness about the importance of secure password practices.

Patching and Updates

Apply security patches provided by Veritas to eliminate the hardcoded credentials vulnerability.