1. Advisory Information
Title: Multiple vulnerabilities in HP Data Protector
Advisory ID: CORE-2011-0514
Advisory URL: http://www.coresecurity.com/content/HP-Data-Protec
Date published: 2011-06-29
Date of last update: 2011-06-29
Vendors contacted: HP
Release mode: Coordinated release
2. Vulnerability Information
Class: Remote stack overflow [CWE-120], Null pointer dereference [CWE-476], Improper input validation [CWE-20]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2011-1865, CVE-2011-1514, CVE-2011-1515
3. Vulnerability Description
HP Data Protector [1] is an automated backup and recovery software for single-server to enterprise environments. Multiple vulnerabilities have been found in HP Data Protector that could allow a remote attacker to execute arbitrary code and lead to denial of service conditions. The vulnerabilities are triggered by sending a request to port 5555 of a host running the "data protector inet" service, part of HP Data Protector. The request has several parameters, including an opcode. By sending requests with specially crafted parameters, the different bugs can be triggered.
4. Vulnerable packages
- HP OpenView Storage Data Protector v6.20 (running on Windows).
- HP OpenView Storage Data Protector v6.11 (running on Windows).
- HP OpenView Storage Data Protector v6.10 (running on Windows).
- HP OpenView Storage Data Protector v6.00 (running on Windows).
- Previous versions may be affected, but were not tested.
5. Non-vulnerable packages
- No fixes are available at the time of publication.
6. Vendor Information, Solutions and Workarounds
HP has issued a security bulletin with document ID c02872182 available through HP Support Center at http://www.hp.com/go/HPSC.
The latest version of HP Data Protector is vulnerable to these issues. HP has provided the following procedure to mitigate these vulnerabilities:
- Upgrade to Data Protector A.06.20 or subsequent.
- Enable encrypted control communication services on cell server and all clients in cell.
7. Credits
This vulnerability was discovered by Oren Isacson from Core Security Technologies. Publication was coordinated by Carlos Sarraute.
8. Technical Description / Proof of Concept Code
The following python script can be used to reproduce the different bugs.
[+ full code]In the following sections, we give the command line details to reproduce each bug, and a brief description of the effect produced.
8.1. Vulnerability 1. Opcodes 20 y 28.
[CVE-2011-1865] This vulnerability can be reproduced with any of the following commands:
"poc.py 127.0.0.1 20 10000 30 13" or "poc.py 127.0.0.1 28 10000 30 6"
This causes a stack overflow.
8.2. Vulnerability 2. Opcode 11.
[CVE-2011-1865] This vulnerability is reproduced with the following command:
"poc.py 127.0.0.1 11 10000 30 17"
A stack overflow is produced within the function swprintf, called from position 0x00411A72.
8.3. Vulnerability 3. Opcode 35.
[CVE-2011-1865] This vulnerability can be reproduced with any of the following commands:
"poc.py 127.0.0.1 35 10000 30 6" or "poc.py 127.0.0.1 35 10000 30 7"
A stack overflow is produced within the function swprintf, called from position 0041367F.
8.4. Vulnerability 4. Opcode 42.
[CVE-2011-1865] This vulnerability is reproduced with the following command:
"poc.py 127.0.0.1 42 10000 30 9"
A stack overflow is produced by calling the function swprintf from position 0x0040A9BA.
8.5. Vulnerability 5. Opcode 46.
[CVE-2011-1865] This vulnerability is reproduced with the following command:
"poc.py 127.0.0.1 46 10000 30 17"
A stack overflow is produced by calling the function swprintf from position 0x0040A708.
8.6. Vulnerability 6. Opcode 27.
[CVE-2011-1865] This vulnerability is reproduced with the following command:
"poc.py 127.0.0.1 27 10000 30 3"
A stack overflow is produced by calling the function swprintf from position 0x0040AD53.
8.7. Vulnerabilidad 7. Opcode 17.
[CVE-2011-1865] This vulnerability is reproduced with the following command:
"poc.py 127.0.0.1 17 10000 30 6"
A stack overflow is produced by calling the function swprintf from position 0x0040FC05.
8.8. Vulnerability 8. Opcode 11.
[CVE-2011-1514] This vulnerability is reproduced with the following command:
"poc.py 127.0.0.1 11 1 7 6"
This causes a null pointer dereference.
8.9. Vulnerability 9. Opcode 20.
[CVE-2011-1515] This vulnerability is reproduced with the following command:
"poc.py 127.0.0.1 20 1 7 6"
The process terminates without generating an exception, resulting in a denial of service condition.
9. Report Timeline
- 2011-06-02: Core Security Technologies notifies HP Security Alert team of the vulnerabilities. Publication date is temporarily set to July 5th, 2011.
- 2011-06-06: Vendor acknowledges receipt.
- 2011-06-06: Core sends technical details to the vendor.
- 2011-06-06: Vendor confirms that a new case was assigned within HP Software Security Response Team (SSRT).
- 2011-06-16: Core requests an update on this issue, in particular Core asks the vendor for a technical analysis of the bugs, a list of affected products and versions, and the vendor's plan for providing a fix (no reply received).
- 2011-06-23: Core requests once more an update.
- 2011-06-28: Vendor communicates that a security bulletin will be issued on the same day (June 28). The vendor confirms the vulnerabilities, and recommends as mitigation to enable encrypted communications in the cell server and client.
- 2011-06-28: Core requests a link to the vendor's bulletin, and asks whether CVE ids have been assigned.
- 2011-06-28: Vendor provides a link to the bulletin and CVE names for the vulnerabilities.
- 2011-06-29: Advisory CORE-2011-0514 is published.
10. References
[1] HP Data Protector http://hp.com/go/dataprotector
11. About CoreLabs
CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.
12. About Core Security Technologies
Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.
13. Disclaimer
The contents of this advisory are copyright (c) 2011 Core Security Technologies and (c) 2011 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/u
14. PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core