Format string vulnerability in the Java user interface service (bpjava-msvc) daemon for VERITAS NetBackup Data and Business Center 4.5FP and 4.5MP and NetBackup Enterprise/Server/Client 5.0 5.1 and 6.0 allows remote attackers to execute arbitrary code via the COMMAND_LOGON_TO_MSERVER command.