Test ID:	1.3.6.1.4.1.25623.1.0.801946
Category:	General
Title:	HP (OpenView Storage) Data Protector Client 'EXEC_CMD' RCE Vulnerability
Summary:	HP (OpenView Storage) Data Protector is prone to a remote code; execution (RCE) vulnerability.
Description:	Summary: HP (OpenView Storage) Data Protector is prone to a remote code execution (RCE) vulnerability. Vulnerability Insight: The specific flaw exists within the filtering of arguments to the 'EXEC_CMD' command. which allows remote connections to execute files within it's local bin directory. Vulnerability Impact: Successful exploitation will allow remote attackers to execute arbitrary Perl code via a crafted command. Affected Software/OS: HP (OpenView Storage) Data Protector 6.11 and prior. Solution: Update to version A.06.20 or later. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-0923 BugTraq ID: 46234 http://www.securityfocus.com/bid/46234 HPdes Security Advisory: HPSBMA02654 http://marc.info/?l=bugtraq&m=130391284726795&w=2 HPdes Security Advisory: SSRT100441 http://dvlabs.tippingpoint.com/blog/2011/02/07/zdi-disclosure-hp http://zerodayinitiative.com/advisories/ZDI-11-055/ http://securityreason.com/securityalert/8261 http://securityreason.com/securityalert/8323 http://securityreason.com/securityalert/8329 http://www.vupen.com/english/advisories/2011/0308
Copyright	Copyright (C) 2011 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.