Arbitrary Code Execution Vulnerability in Veritas NetBackup and OpsCenter

CVE-2020-36169

Summary

A vulnerability exists in Veritas NetBackup and OpsCenter that may allow a low privileged user to execute arbitrary code. This occurs when the software attempts to load libraries from paths that may be created by users on Windows systems. If an attacker, with limited privileges, creates a malicious path that matches the expected library loading location, they can gain SYSTEM or Administrator-level access. This exposes the system to unauthorized access to data, applications, and system controls, affecting not just installations but the normal functioning of the software throughout its operational period.

References