HP Data Protector Media Operation 'DBServer.exe' Heap Buffer Overflow Vulnerability

Bugtraq ID:	50558
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 07 2011 12:00AM
Updated:	Nov 07 2011 12:00AM
Credit:	Luigi Auriemma
Vulnerable:	HP Data Protector Media Operations 6.20
Not Vulnerable:

HP Data Protector Media Operation 'DBServer.exe' Heap Buffer Overflow Vulnerability

HP Data Protector Media Operation is prone to a remote heap-based buffer-overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of an application using the affected library. Failed exploit attempts will result in denial-of-service conditions.

HP Data Protector Media Operations 6.20 is vulnerable; other versions may also be affected.

HP Data Protector Media Operation 'DBServer.exe' Heap Buffer Overflow Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/50558.zip

HP Data Protector Media Operation 'DBServer.exe' Heap Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HP Data Protector Media Operation 'DBServer.exe' Heap Buffer Overflow Vulnerability

References:

• HP Data Protector Media Operations Download Page (HP)
  
• HP Data Protector Media Operations (Luigi Auriemma)