Secunia

Some vulnerabilities have been reported in HP Storage Data Protector, which can be exploited by malicious people to compromise a vulnerable system.

1) A boundary error exists when processing MSG_PROTOCOL (0x010b) packets sent to the OmniInet process. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted packet to port 5555/TCP.

This may be related to:
SA37600

2) An integer overflow in the Cell Manager Database Service (rds.exe) can be exploited to cause a heap-based buffer overflow via a specially crafted packet sent to port 1530/TCP.

3) A boundary error exists in the Cell Manager Service when processing certain packets with opcode 0x18. This can be exploited to cause a stack-based buffer overflow via a specially crafted packet sent to port 1030/TCP.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

Solution
Apply patches (please see the vendor advisory for details).
Further details available in Customer Area

Provided and/or discovered by
1) Aaron Portnoy of TippingPoint DVLabs, and Tenable Network Security working with ZDI
2) Pedram Amini of TippingPoint DVLabs, and an anonymous person
3) Aaron Portnoy of TippingPoint DVLabs

Changelog
Further details available in Customer Area

Original Advisory
HPSBMA02252 SSRT061258, SSRT061259:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01124817

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-09-099/

TippingPoint DVLabs:
http://dvlabs.tippingpoint.com/advisory/TPTI-09-15
http://dvlabs.tippingpoint.com/advisory/TPTI-10-01

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area