HP OpenView Data Protector Application Recovery Manager Stack Buffer Overflow Vulnerability
BID:37250
Info
HP OpenView Data Protector Application Recovery Manager Stack Buffer Overflow Vulnerability
| Bugtraq ID: | 37250 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2009-3844 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 08 2009 12:00AM |
| Updated: | Jan 07 2010 08:32AM |
| Credit: | Stephen Fewer of Harmony Security working with the TippingPoint Zero Day Initiative |
| Vulnerable: |
HP OpenView Data Protector Application Recovery Manager 6.0 HP OpenView Data Protector Application Recovery Manager 5.50 |
| Not Vulnerable: | |
Discussion
HP OpenView Data Protector Application Recovery Manager Stack Buffer Overflow Vulnerability
HP OpenView Data Protector Application Recovery Manager is prone to a remote stack-based buffer-overflow vulnerability.
An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will completely compromise affected computers. Failed exploit attempts will result in a denial-of-service condition.
OpenView Data Protector Application Recovery Manager 5.50 and 6.0 are vulnerable.
NOTE: The vendor reports this as a denial-of-service vulnerability, but further information suggests that the issue can be exploited to execute arbitrary code.
HP OpenView Data Protector Application Recovery Manager is prone to a remote stack-based buffer-overflow vulnerability.
An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will completely compromise affected computers. Failed exploit attempts will result in a denial-of-service condition.
OpenView Data Protector Application Recovery Manager 5.50 and 6.0 are vulnerable.
NOTE: The vendor reports this as a denial-of-service vulnerability, but further information suggests that the issue can be exploited to execute arbitrary code.
Exploit / POC
HP OpenView Data Protector Application Recovery Manager Stack Buffer Overflow Vulnerability
The following exploits are available:
The following exploits are available:
Solution / Fix
HP OpenView Data Protector Application Recovery Manager Stack Buffer Overflow Vulnerability
Solution:
The vendor has released fixes. Please see the references for details.
Solution:
The vendor has released fixes. Please see the references for details.
References
HP OpenView Data Protector Application Recovery Manager Stack Buffer Overflow Vulnerability
References:
References:
- Hewlett-Packard Application Recovery Manager MSG_PROTOCOL Stack Overflow Vulnera (Zero Day Initiative)
- Micro News Homepage (phptoys)
- [security bulletin] HPSBMA02481 SSRT090113 rev.1 - HP OpenView Data Protector Ap ([email protected])
- ZDI-09-091: Hewlett-Packard Application Recovery Manager MSG_PROTOCOL Stack Over (ZDI Disclosures