HP Storage Data Protector Multiple Remote Code Execution Vulnerabilities

Bugtraq ID:	64647
Class:	Unknown
CVE:	CVE-2013-2344 CVE-2013-2345 CVE-2013-2346 CVE-2013-2347 CVE-2013-2348 CVE-2013-2349 CVE-2013-2350 CVE-2013-6194 CVE-2013-6195
Remote:	Yes
Local:	No
Published:	Jan 02 2014 12:00AM
Updated:	Oct 14 2014 12:59AM
Credit:	[email protected] and Brian Gorenc
Vulnerable:
Not Vulnerable:

HP Storage Data Protector Multiple Remote Code Execution Vulnerabilities

HP Data Protector is prone to multiple remote code execution vulnerabilities.

Attackers can exploit these issues to execute arbitrary code, gain elevated privileges, or cause denial-of-service conditions. This may aid in further attacks.

HP Storage Data Protector Multiple Remote Code Execution Vulnerabilities

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploits are available:

• /data/vulnerabilities/exploits/64647.rb
• /data/vulnerabilities/exploits/64647_2.rb
• /data/vulnerabilities/exploits/64647_3.rb

HP Storage Data Protector Multiple Remote Code Execution Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

HP Storage Data Protector Multiple Remote Code Execution Vulnerabilities

References:

• HP Homepage (HP)