CVE-2015-6551: Infoleak
Veritas NetBackup 7.x through 7.5.0.7 and 7.6.0.x through 7.6.0.4 and NetBackup Appliance through 2.5.4 and 2.6.0.x through 2.6.0.4 do not use TLS for administration-console traffic to the NBU server, which allows remote attackers to obtain sensitive information by sniffing the network for key-exchange packets.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-6551?
CVE-2015-6551 has a medium severity rating due to the potential exposure of sensitive information.
How do I fix CVE-2015-6551?
To fix CVE-2015-6551, it is recommended to enable TLS for administration-console traffic to the NBU server.
Which versions are affected by CVE-2015-6551?
CVE-2015-6551 affects Veritas NetBackup versions 7.x through 7.5.0.7 and 7.6.0.x through 7.6.0.4 as well as several versions of NetBackup Appliance.
What type of attack can exploit CVE-2015-6551?
CVE-2015-6551 can be exploited by remote attackers to obtain sensitive information by sniffing the network during administration-console traffic.
Is there a workaround for CVE-2015-6551?
A workaround for CVE-2015-6551 is to restrict network access to the administration console to trusted hosts only.