HP StorageWorks Storage Mirroring Software 'DoubleTake.exe' Remote Code Execution Vulnerability

Bugtraq ID:	29499
Class:	Boundary Condition Error
CVE:	CVE-2008-1661
Remote:	Yes
Local:	No
Published:	Jun 02 2008 12:00AM
Updated:	Jun 02 2008 12:00AM
Credit:	Titon of BastardLabs and TippingPoint's Zero Day Initiative
Vulnerable:	Double-Take Software Double-Take 4.5 .1629
Not Vulnerable:	HP HP StorageWorks Storage Mirroring Software 5.0 HP HP StorageWorks Storage Mirroring Software 4.5 SP2

HP StorageWorks Storage Mirroring Software 'DoubleTake.exe' Remote Code Execution Vulnerability

HP StorageWorks Storage Mirroring Software (SWSM) is prone to a remote code-execution vulnerability.

Exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the affected application.

The issue affects SWSM 4.5 SP1.

HP StorageWorks Storage Mirroring Software 'DoubleTake.exe' Remote Code Execution Vulnerability

The following Metasploit Framework exploit module is available:

• /data/vulnerabilities/exploits/29499.rb
• /data/vulnerabilities/exploits/29499.rb
• /data/vulnerabilities/exploits/29499.rb

HP StorageWorks Storage Mirroring Software 'DoubleTake.exe' Remote Code Execution Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.

HP StorageWorks Storage Mirroring Software 'DoubleTake.exe' Remote Code Execution Vulnerability

References:

• HP StorageWorks Storage Mirroring Software Homepage (HP)
  
• Re: ZDI-08-034: HP StorageWorks Storage Mirroring Authentication Processing Stac (Luigi Auriemma )
  
• ZDI-08-034: HP StorageWorks Storage Mirroring Authentication Processing Stack Ov ([email protected])
  
• HP StorageWorks Storage Mirroring Authentication Processing Stack Overflow Vulne (Zero Day Initiative)
  
• HPSBST02312 SSRT071428 rev.1 - HP StorageWorks Storage Mirroring Software, Remot (HP)