|
|
| |
Credit:
The information has been provided by AbdulAziz Hariri.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-11-024/
|
| |
Vulnerable Systems:
* Hewlett-Packard Data Protector
Authentication is not required to exploit these vulnerabilities.
The specific flaws exist within the crs.exe process which listens on a random TCP port. The process fails to properly handle multiple message types and copies user-supplied data into fixed-length buffers. A remote attacker can abuse this to execute remote code under the context of the SYSTEM user.
Patch Availability:
Hewlett-Packard has issued an update to correct this vulnerability. More details can be found at:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02688353
CVE Information:
CVE-2011-0273
Disclosure Timeline:
2010-06-02 - Vulnerability reported to vendor
2011-01-20 - Coordinated public release of advisory
|
|
|
