Two vulnerabilities have been reported in HP Data Protector Express, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

1) A boundary error in the "DtbClsLogin()" function within dpwindtb.dll (Windows) and libdplindtb.so (Linux) can be exploited to cause a stack-based buffer overflow via an overly long string.

Successful exploitation may allow execution of arbitrary code.

2) A NULL pointer dereference error in the "PrvRecvRqu()" function within dpwinsup can be exploited to cause an unhandled exception error and crash the service via a specially crafted request sent to TCP port 3817.

The vulnerabilities are reported in the following products running on Windows, Linux, and Novell NetWare:
* HP Data Protector Express 3.x and HP Data Protector Express SSE 3.x prior to build 56936
* HP Data Protector Express 4.x and HP Data Protector Express SSE 4.x prior to build 56906

Solution
Update to 3.5 SP2 build 56936 or later and to 4.0 SP1 build 56906 or later.

Provided and/or discovered by
AbdulAziz Hariri of Insight Technologies, reported via ZDI.

Changelog
Further details available to Secunia VIM customers

Original Advisory
HPSBMA02576 SSRT090231:
http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02498535

HPSBMA02516 SSRT090232:
http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02067559

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-174/
http://www.zerodayinitiative.com/advisories/ZDI-10-175/

Deep Links
Links available to Secunia VIM customers