CVE-2022-36956: 
Veritas NetBackup Client vulnerability analysis and mitigation

CVE-2022-36956 is a critical vulnerability discovered in Veritas NetBackup Client that allows arbitrary command execution from any remote host with access to a valid host-id NetBackup certificate/private key from the same domain. The vulnerability affects NetBackup versions 9.0.x through 9.0.0.1 and 9.1.x through 9.1.0.1, and was disclosed in July 2022 (Veritas Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H), indicating its critical severity. The attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C), with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) (Veritas Advisory).

The vulnerability allows an attacker with access to valid NetBackup certificate/private key to execute arbitrary commands on the affected systems. This could potentially lead to complete system compromise, data breach, and service disruption (NVD).

Veritas recommends several mitigation options: upgrade NetBackup Client to version 10.0 (no HotFix needed), upgrade to version 9.1.0.1 and apply VTS22-008 HotFix (Etrack 4066508), or upgrade to version 9.0.0.1 and apply VTS22-008 HotFix (Etrack 4067247). NetBackup Client versions 8.3.x and earlier are not vulnerable to this issue (Veritas Advisory).