HP Data Protector Express Crafted Traffic Remote Memory Disclosure

medium Nessus Plugin ID 38792

Synopsis

The remote Windows host contains an application that is affected by a local privilege escalation vulnerability.

Description

HP Data Protector Express is installed on the remote host. The installed version of the software is affected by an unspecified local privilege escalation vulnerability. A local attacker could exploit this vulnerability to trigger a denial of service condition or execute arbitrary code with system level privileges. According to reports, this flaw could also be triggered remotely by exploiting a memory leak vulnerability, see references for more information.

Solution

Upgrade to HP Data Protector Express Single Server Edition version 3.5 SP2 build 47065 / 4.0 SP1 build 46537 or later.

Plugin Details

Severity: Medium

ID: 38792

File Name: hp_data_protector_exp_priv_escalation.nasl

Version: 1.15

Type: local

Agent: windows

Family: Windows

Published: 5/15/2009

Updated: 11/15/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:hp:storage_data_protector

Required KB Items: SMB/HP Data Protector Express/Path, SMB/HP Data Protector Express/Version, SMB/HP Data Protector Express/Build

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/13/2009

Reference Information

CVE: CVE-2009-0714

BID: 34955

Secunia: 35084

Detections

Analytics