security alert - Java Authentication Service

[Stumpr]

Dear Valued Symantec Customer,

This is to inform you that Symantec Enterprise Technical Support has just issued a security alert. This is a critical technical issue for:

VERITAS NetBackup (tm) DataCenter 4.5 - including all present Maintenance Packs and Feature Packs

VERITAS NetBackup (tm) BusinesServer 4.5 - including all present Maintenance Packs and Feature Packs

VERITAS NetBackup (tm) Enterprise Server 5.0, 5.1, and 6.0 - including all present Maintenance Packs for each version

VERITAS NetBackup (tm) Server 5.0, 5.1, and 6.0 - including all present Maintenance Packs for each version

For a detailed description of this issue and our recommendations, please review the following reference document:

http://support.veritas.com/docs/279085

If you would like to continue to receive updates regarding this particular issue, you may subscribe to the reference document. Symantec recommends subscription to ensure that you always have the latest information available for your immediate review. To initiate a subscription, click on the Subscribe to this document link in the document itself, or visit the following URL:

http://maillist.support.veritas.com/notification_services.asp?doc=279085

This software alert was generated because product quality and responsiveness to customers are consistent Symantec Corporation hallmarks. Any issues that could potentially affect the integrity of the data in your environment, no matter how rare, are viewed as extremely serious.

Thank you for choosing Symantec.

Sincerely,
Symantec


Bob Stump
Just because the VERITAS documentation states a certain thing does not make it a fact and that is truth.

 

[xxx01]

Can someone confirm this for me?

Do we need to install this patch on all NB Servers and Clients?

 

[dmorgens]

Also, they say all platforms but I can't seem to find Novell patches.

 

[willster]

We put the patch on all of our master and media servers. I wasn't to happy about upgrading from 5.1 mp2 to mp3a to apply a security patch, but that's what we did. We just turned off the port on all of our clients, we don't use the java feature anyway. And I didn't see any netware patches either.

 

[Vela]

I don't get the part where it say's that if you are running 5.0, you will have to have all the clients servers etc.. patched up to 5.0 Mp5 before applying the patch...MP5 doesn't exist..

Down at the bottom is say's that if you block port 13722 you will have won half the battle...the only other exploits would be from internal hackers..