HP Data Protector Remote Command Execution

Critical Nessus Plugin ID 53641

Synopsis

The remote service allows remote execution of arbitrary commands without authentication.

Description

The remote HP Data Protector client or server service is affected by a command execution vulnerability. A malicious user can send a specially crafted packet that causes this service to execute an arbitrary shell command with system privileges.

Solution

1. Upgrade to Data Protector A.06.20 or later and

2. Enable encrypted control communication services on cell server and all clients in cell.

See Also

http://www.zerodayinitiative.com/advisories/ZDI-11-055/

http://seclists.org/bugtraq/2011/Feb/73

http://www.nessus.org/u?6ca03389

Plugin Details

Severity: Critical

ID: 53641

File Name: hp_data_protector_command_execution.nbin

Version: $Revision: 1.39 $

Type: remote

Published: 2011/05/03

Modified: 2018/08/15

Dependencies: 19601, 11936

Risk Information

Risk Factor: Critical

CVSSv2

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:hp:openview_storage_data_protector

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2011/04/25

Vulnerability Publication Date: 2011/02/07

Exploitable With

CANVAS (White_Phosphorus)

Metasploit (HP Data Protector 6 EXEC_CMD Remote Code Execution)

Reference Information

CVE: CVE-2011-0923

BID: 46234

EDB-ID: 17339, 17648, 18521, 27400