This Metasploit module exploits a stack-based buffer overflow in the Hewlett-Packard OmniInet NT Service. By sending a specially crafted MSG_PROTOCOL (0x010b) packet, a remote attacker may be able to execute arbitrary code with elevated privileges. This service is installed with HP OpenView Data Protector, HP Application Recovery Manager and potentially other products. This exploit has been tested against versions 6.1, 6.0, and 5.50 of Data Protector. and versions 6.0 and 6.1 of Application Recovery Manager. NOTE: There are actually two consecutive wcscpy() calls in the program (which may be why ZDI considered them two separate issues). However, this module only exploits the first one.
098a37312c7769272d53b6747df73473c2997a18bf5130110137953613125b72Zero Day Initiative Advisory 09-099 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Storage Data Protector. Authentication is not required to exploit this vulnerability. The specific flaw exists within the backup client service daemon (OmniInet.exe), which binds to TCP port 5555. During the processing of long arguments to the 'MSG_PROTOCOL' command, a stack based buffer overflow occurs and can result in code execution under the context of the daemon.
0f9de733412a100a34ae3d1de1051cd6038931fcd0ebdc100541b769c8372c53HP Security Bulletin - Potential security vulnerabilities have been identified with HP OpenView Storage Data Protector running on HP-UX, Windows, Linux and Solaris. These vulnerabilities could be exploited remotely to execute arbitrary code.
6cc8f95ed238f04230a64989f4543105eec588432c89532c7c415c015f512406
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed