This vulnerability allows remote
attackers to execute arbitrary code on vulnerable installations of HP
StorageWorks File Migration Agent. Authentication is not required to exploit
this vulnerability.
Release Date 2012-18-07
Severity: High
Impact
· Remote Code Execution
Vulnerability
Software:
· Hewlett-Packard StorageWorks
ZDI Reference(s)
ZDI-12-127
Description
The specific flaw exists within the
HsmCfgSvc.exe service which listens by default on TCP port 9111. When
processing FTP archives the process does not properly validate the size of the
root path specified and proceeds to copy the string into a fixed-length buffer
on the stack. This can be exploited to execute arbitrary remote code under the
context of the running service.
.
Solution
No known mitigation exists.
NOTE:The Information provided is on "as is" basis, without
assurance of any kind.