[R1] HP Data Protector Multiple Remote Vulnerabilities

Tenable found two new vulnerabilities in HPE Data Protector's OmniInet.exe while researching HPSBGN03580.

FTP_PUT_FILE Request Stack Buffer Overflow

OmniInet.exe blindly copies the filename value from FTP_PUT_FILE requests into a fixed length stack buffer. Due to the lack of length checking an unauthenticated remote attacker can crash the remote process or potentially execute remote code under the context of SYSTEM.

.text:00413280      mov     eax, g_field_array
.text:00413285      mov     ecx, [eax+REQ_RxFtp.fileName] ; user-controlled data
.text:00413288      push    ecx                        ; int
.text:00413289      lea     edx, [ebp+var_80C]         ; stack buf of fixed size
.text:0041328F      push    edx                        ; wchar_t *
.text:00413290      call    StrCpyNS 

EXEC_SCRIPT argc Field Handling Denial of Service

A user, when submitting an EXEC_SCRIPT request, can specify a program to run, a list of program arguments, and a list of environment variables. The user supplied argc field indicates how many program arguments there are. However, OmniInet.exe never validates argc is reasonable or correct. An unauthenticated remote attacker can specify a large argc value without including the corresponding number of program arguments. This will cause OmniInet.exe to try and loop through argc amount of program arguments which eventually leads to a crash.