PT-2011-3427 · Hewlett Packard · Hp Openview Storage Data Protector

Published 2011-07-01 · Updated 2018-10-09 · CVE-2011-1866

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP OpenView Storage Data Protector versions 6.00 through 6.20

Description The issue is related to a buffer overflow in the omniinet.exe component of the inet service, which allows remote attackers to execute arbitrary code through a crafted request. This is specifically tied to the EXEC CMD functionality.

Recommendations For HP OpenView Storage Data Protector versions 6.00 through 6.20, consider disabling the EXEC CMD functionality in the omniinet.exe component as a temporary workaround until a patch is available. Restrict access to the inet service to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-1866

Affected Products

Hp Openview Storage Data Protector

References · 11

• 🔥 http://exploit-db.com/exploits/17461 · Exploit
• 🔥 https://exploit-db.com/exploits/17461 · Exploit
• 🔥 http://coresecurity.com/content/HP-Data-Protector-EXECCMD-Vulnerability · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-1866 · Security Note
• http://secunia.com/advisories/45100 · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68297 · Note
• http://securitytracker.com/id?1025731 · Note
• http://securityreason.com/securityalert/8289 · Note
• http://securityfocus.com/bid/48488 · Note
• http://securityfocus.com/archive/1/518666/100/0/threaded · Note