Multiple vulnerabilities have been reported in HP Data Protector, which can be exploited by malicious people to conduct SQL injection attacks.

1) Input passed via the "userid" parameter to the "LogClientInstallation()" method within the dpnepolicyservice component is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed via the "clientVersion" parameter to the "GetPolicies()" method within the dpnepolicyservice component is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

3) Input passed via the "type" parameter to the "RequestCopy()" and "FinishedCopy()" methods within the dpnepolicyservice component is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

4) Input passed via the "clientHealth" parameter to the "LogClientHealth()" method within the dpnepolicyservice component is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

5) Input passed via the "copyStatus" parameter to the "LogCopyOperation()" method within the dpnepolicyservice component is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

6) Input passed via the "backupLocationStatus" parameter to the "LogBackupLocationStatus()" method within the dpnepolicyservice component is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities are reported in the following versions:
* HP Data Protector Notebook Extension prior to 6.20.
* HP Data Protector for PCs 7.0.

Solution
Apply the DPPCWIN_00001 patch.

Provided and/or discovered by
Andrea Micalizzi aka rgod via ZDI.

Changelog
Further details available to Secunia VIM customers

Original Advisory
HPSBMU02716 SSRT100651:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03058866

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-321/
http://www.zerodayinitiative.com/advisories/ZDI-11-322/
http://www.zerodayinitiative.com/advisories/ZDI-11-323/
http://www.zerodayinitiative.com/advisories/ZDI-11-324/
http://www.zerodayinitiative.com/advisories/ZDI-11-325/
http://www.zerodayinitiative.com/advisories/ZDI-11-326/
http://www.zerodayinitiative.com/advisories/ZDI-11-327/

Deep Links
Links available to Secunia VIM customers