HP Data Protector
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01697543
Version: 2
HPSBMA02417 SSRT090031 rev.2 - HP Data Protector Express and HP Data Protector Express Single Server
Edition (SSE), Local Denial of Service (DoS), Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01697543
Version: 1
HPSBMA02417 SSRT090031 rev.1 - HP Data Protector Express and HP Data Protector Express Single Server Edition (SSE), Local Denial of Service (DoS), Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2009-05-13
Last Updated: 2009-05-12
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c02498535
Version: 1
HPSBMA02576 SSRT090231 rev.1 - HP Data Protector Express and HP Data Protector Express Single Server Edition (SSE), Local Denial of Service (DoS), Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2010-09-08
Last Updated: 2010-09-08
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c02067559
Version: 1
HPSBMA02516 SSRT090232 rev.1 - HP Data Protector Express and HP Data Protector Express Single Server Edition (SSE), Local
Denial of Service (DoS), Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Hash: SHA1
Core Security Technologies - Corelabs Advisory
http://corelabs.coresecurity.com/
HP Data Protector EXEC_CMD Buffer Overflow Vulnerability
1. *Advisory Information*
Title: HP Data Protector EXEC_CMD Buffer Overflow Vulnerability
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03229235
Version: 1
HPSBMU02746 SSRT100781 rev.1 - HP Data Protector Express, Remote Denial of Service (DoS), Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2012-03-12
Last Updated: 2012-03-12
Hash: SHA1
Core Security Technologies - Corelabs Advisory
http://corelabs.coresecurity.com/
Multiple vulnerabilities in HP Data Protector
1. *Advisory Information*
Title: Multiple vulnerabilities in HP Data Protector
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03058866Version: 1
HPSBMU02716 SSRT100651 rev.1 - HP Data Protector Notebook Extension, Remote Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2011-10-18Last Updated: 2011-10-18
________________________________________
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c02940981
Version: 1
HPSBMU02669 SSRT100346 rev.3 - HP Data Protector Media Management Daemon (mmd), Remote Denial of Service (DoS)
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2011-07-27
Last Updated: 2011-07-27
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03179046
Version: 2
HPSBMU02739 SSRT100280 rev.2 - HP Data Protector Storage Media Operations (SMO), Remote Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2012-02-01
Last Updated: 2012-02-22
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03179046
Version: 1
HPSBMU02739 SSRT100280 rev.1 - HP Data Protector Media Operations, Remote Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2012-02-01
Last Updated: 2012-02-01
ZDI-11-145: HP Data Protector Backup Client Service GET_FILE Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-11-145
April 29, 2011
-- CVE ID:
CVE-2011-1729
-- CVSS:
ZDI-11-149: HP Data Protector Backup Client Service HPFGConfig Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-11-149
April 29, 2011
-- CVE ID:
CVE-2011-1733
-- CVSS:
ZDI-11-144: HP Data Protector Backup Client Service EXEC_BAR Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-11-144
April 29, 2011
-- CVE ID:
CVE-2011-1728
-- CVSS:
ZDI-11-147: HP Data Protector Backup Client Service EXEC_INTEGUTIL Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-11-147
April 29, 2011
-- CVE ID:
CVE-2011-1731
-- CVSS:
ZDI-11-146: HP Data Protector Backup Client Service EXEC_SCRIPT Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-11-146
April 29, 2011
-- CVE ID:
CVE-2011-1730
-- CVSS:
ZDI-11-148: HP Data Protector Backup Client Service stutil Message Processing Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-11-148
April 29, 2011
-- CVE ID:
CVE-2011-1732
-- CVSS:
ZDI-11-152: HP Data Protector Backup Client Service GET_FILE Directory Traversal Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-11-152
April 29, 2011
-- CVE ID:
CVE-2011-1736
-- CVSS:
ZDI-11-150: HP Data Protector Backup Client Service omniiaputil Message Processing Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-11-150
April 29, 2011
-- CVE ID:
CVE-2011-1734
-- CVSS:
ZDI-11-151: HP Data Protector Backup Client Service bm Message Processing Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-11-151
April 29, 2011
-- CVE ID:
CVE-2011-1735
-- CVSS:
# ===============================
# HP Data Protector Manager v6.11
# ===============================
#
# Bug: NULL Pointer Dereference Remote Denial of Service Vulnerabilities
#
# Software: http://www.hp.com
# Date: 06/10/2010
# Author: Pepelux - pepelux[AT]enye-sec[DOT]com
# http://www.enye-sec.org - http://www.pepelux.org
http://www.tippingpoint.com
-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of HP Data Protector. Authentication is not
required to exploit this vulnerability.
The specific flaw exists within the DBServer.exe process which listens
by default on TCP port 19813. While parsing a request, the process
trusts a user-supplied 32-bit length value and uses it within a memory
|
