CVE-2022-45461: 
Veritas NetBackup Client vulnerability analysis and mitigation

The Java Admin Console in Veritas NetBackup through version 10.1 and related Veritas products on Linux and UNIX systems contains a high-severity vulnerability (CVE-2022-45461) that was disclosed on November 17, 2022. This vulnerability allows authenticated non-root users who have been explicitly added to the auth.conf file to execute arbitrary commands with root privileges (NVD, Veritas Advisory).

The vulnerability is classified as an OS Command Injection (CWE-78) with a CVSS v3.1 base score of 8.8 (HIGH). The issue specifically affects the /usr/openv/java/auth.conf file, which grants access to functions in the NetBackup Administration Console. By default, this file is created with only root having administrative rights and is present on Primary Servers, Media Servers, and Clients (Veritas Advisory).

The vulnerability affects Unix-based servers and clients running NetBackup, potentially impacting a significant number of organizations as 87% of Fortune Global 500 companies use NetBackup. If exploited, authenticated non-root users could execute arbitrary commands with root privileges, potentially leading to complete system compromise (Security Online).

Veritas has released patches to address this vulnerability. Users are recommended to upgrade to NetBackup versions 8.2, 8.3.0.1, 8.3.0.2, 9.0.0.1, 9.1.0.1, 10.0.0.1, or 10.1 and apply the corresponding hotfix. For NetBackup Appliance users, upgrading to versions 3.2, 3.3.0.1, 3.3.0.2, 4.0.0.1, 4.1.0.1, or 5.0.0.1 MR1 with appropriate hotfix is recommended. Flex Appliance users should apply the NetBackup hotfix corresponding to their NetBackup Container version (Veritas Advisory).

The vulnerability was initially reported by the Nordea Backup Team to Veritas, demonstrating active security research in the enterprise backup software community (Veritas Advisory).