Veritas NetBackup Unquoted Service Path Vulnerability in INET Daemon Allowing Arbitrary Code Execution

A vulnerability exists in Veritas NetBackup version 7.0, specifically within the NetBackup INET Daemon service. This unquoted service path vulnerability allows local users to execute arbitrary code. The issue arises from the unquoted path in 'C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe', which can be exploited to inject malicious code that executes with elevated LocalSystem privileges.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution with elevated privileges.

Reproduction

The vulnerability can be reproduced by exploiting the unquoted service path of the NetBackup INET Daemon. A local user must place malicious code in a location that the operating system will execute during application startup or system reboot, taking advantage of the elevated privileges of the NetBackup service.