Secunia

Some vulnerabilities and a security issue has been reported in EMC Retrospect, which can be exploited by malicious people to disclose sensitive information or cause a DoS (Denial of Service).

1) An error in retroclient.exe can be exploited to cause the process to terminate via specially crafted packets sent to default port 497/TCP.

2) A NULL pointer dereference error can be exploited to cause a DoS via specially crafted packets sent to default port 497/TCP.

3) It is possible to disclose e.g. the password hash in plaintext via a specially crafted packet sent to the EMC Retrospect Client. Additionally, the authentication module of the EMC Retrospect Server reportedly uses a weak password hash arithmetic, which can be brute-forced.

The vulnerabilities and security issue are reported in version 7.5.116 (Client) and 7.5.508 (Server).

Solution
Update to the latest versions.
Further details available in Customer Area

Provided and/or discovered by
Zhenhua Liu, Fortinet's FortiGuard Global Security Research Team

Changelog
Further details available in Customer Area

Original Advisory
Fortinet:
http://www.fortiguardcenter.com/advisory/FGA-2008-16.html
http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063354.html
http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063353.html
http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063351.html

Deep Links
Links available in Customer Area