HP Data Protector Omnilnet.exe EXEC_SCRIPT RCE Vulnerability (CVE-2011-1730) Analysis

Vulnerability Key Information Basic Information Release Date: April 29, 2011 Vulnerability Name: HP Data Protector Backup Client Service EXEC_SCRIPT Remote Code Execution Vulnerability ZDI ID: ZDI-11-146 ZDI-CAN ID: ZDI-CAN-1173 CVE ID: CVE-2011-1730 CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) Affected Information Affected Vendor: Hewlett-Packard Affected Product: Data Protector Vulnerability Details Vulnerability Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable HP OpenView Data Protector installations. Exploitation of this vulnerability does not require authentication. Specific Vulnerability: - The issue resides in the Backup Client Service (Omnilnet.exe). This service communicates between systems via TCP port 5555. - The process performs insufficient boundary checking on user-supplied data over a fixed-length stack buffer. - A remote, unauthenticated attacker can exploit this vulnerability by sending a maliciously crafted EXEC_SCRIPT message packet to the target, potentially leading to arbitrary code execution with SYSTEM user privileges. Mitigation Measures Trend Micro Customer Protection: - Trend Micro TippingPoint IPS customers are protected via Digital Vaccine protection filter ID ['11133']. - More product information Patches and Updates Vendor Update: Hewlett-Packard has released an update to fix this vulnerability. More information Disclosure Timeline 2011-04-04: Vulnerability reported to vendor 2011-04-29: Coordinated advisory release Acknowledgments Reporter: Aniway (Aniway.Anyway@gmail.com)

Goal Reached Thanks to every supporter — we hit 100%!

HP Data Protector Omnilnet.exe EXEC_SCRIPT RCE Vulnerability (CVE-2011-1730) Analysis