HP OpenView Storage Data Protector Multiple Remote Code Execution Vulnerabilities
BID:47638
Info
HP OpenView Storage Data Protector Multiple Remote Code Execution Vulnerabilities
| Bugtraq ID: | 47638 |
| Class: | Unknown |
| CVE: |
CVE-2011-1728 CVE-2011-1729 CVE-2011-1730 CVE-2011-1731 CVE-2011-1732 CVE-2011-1733 CVE-2011-1734 CVE-2011-1735 CVE-2011-1736 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 29 2011 12:00AM |
| Updated: | Apr 29 2011 07:03PM |
| Credit: | Aniway working with the Zero Day Initiative |
| Vulnerable: |
HP OpenView Storage Data Protector 6.11 HP OpenView Storage Data Protector 6.10 HP OpenView Storage Data Protector 6.1 HP OpenView Storage Data Protector 6.0 |
| Not Vulnerable: | |
Discussion
HP OpenView Storage Data Protector Multiple Remote Code Execution Vulnerabilities
HP OpenView Storage Data Protector is prone to multiple buffer-overflow vulnerabilities and an information-disclosure vulnerability.
An attacker can exploit these issues to execute arbitrary code with SYSTEM-level privileges and obtain potentially sensitive information. Successful exploits will completely compromise an affected computer.
HP OpenView Storage Data Protector is prone to multiple buffer-overflow vulnerabilities and an information-disclosure vulnerability.
An attacker can exploit these issues to execute arbitrary code with SYSTEM-level privileges and obtain potentially sensitive information. Successful exploits will completely compromise an affected computer.
Exploit / POC
HP OpenView Storage Data Protector Multiple Remote Code Execution Vulnerabilities
Currently, we are not aware of any working exploits for the buffer-overflow issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
The attacker can exploit the information disclosure issue with a browser.
Currently, we are not aware of any working exploits for the buffer-overflow issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
The attacker can exploit the information disclosure issue with a browser.
Solution / Fix
HP OpenView Storage Data Protector Multiple Remote Code Execution Vulnerabilities
Solution:
Vendor updates are available. Please see the referenced vendor advisory for more information.
Solution:
Vendor updates are available. Please see the referenced vendor advisory for more information.
References
HP OpenView Storage Data Protector Multiple Remote Code Execution Vulnerabilities
References:
References:
- HP Homepage (HP)
- HPSBMA02668 SSRT100474 rev.1 - HP OpenView Storage Data Protector, Remote Execut ([email protected])
- ZDI-11-144 HP Data Protector Backup Client Service EXEC_BAR Remote Code Executio (Zero Day Initiative)
- ZDI-11-145 HP Data Protector Backup Client Service GET_FILE Remote Code Executio (Zero Day Initiative)
- ZDI-11-146 HP Data Protector Backup Client Service EXEC_SCRIPT Remote Code Execu (Zero Day Initiative)
- ZDI-11-147 HP Data Protector Backup Client Service EXEC_INTEGUTIL Remote Code Ex (Zero Day Initiative)
- ZDI-11-148 HP Data Protector Backup Client Service stutil Message Processing Rem (Zero Day Initiative)
- ZDI-11-149 HP Data Protector Backup Client Service HPFGConfig Remote Code Execut (Zero Day Initiative)
- ZDI-11-150 HP Data Protector Backup Client Service omniiaputil Message Processin (Zero Day Initiative)
- ZDI-11-151 HP Data Protector Backup Client Service bm Message Processing Remote (Zero Day Initiative)
- ZDI-11-152 HP Data Protector Backup Client Service GET_FILE Directory Traversal (Zero Day Initiative)