Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Veritas NetBackup can run unauthorized code via bpcd service

CVE-2006-6222 · published 19 years ago
Summary

The NetBackup software (client, server, and enterprise versions) has a coding error in its bpcd component that can be triggered by a specially crafted network request. An attacker could make the software run their own programs, potentially taking control of the backup system. Apply the latest NetBackup updates or patches to fix the issue and restrict network access to the bpcd service until then.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
symantec veritas_netbackup_client 5.0
5.1
6.0
cpe:2.3:a:symantec:veritas_netbackup_client:5.0:*:*:*:*:*:*:*
symantec veritas_netbackup_enterprise_server 5.0
5.1
6.0
cpe:2.3:a:symantec:veritas_netbackup_enterprise_server:5.0:*:*:*:*:*:*:*
symantec veritas_netbackup_server 5.0
5.1
6.0
cpe:2.3:a:symantec:veritas_netbackup_server:5.0:*:*:*:*:*:*:*
Original advisory text
Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 allows remote attackers to execute a...
Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 allows remote attackers to execute arbitrary code via a long request with a malformed length prefix.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
12% chance of attack within 30 days
Timeline
Published14 Dec 2006
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-6222 · NVD
Track software like this
Free during beta