The client in HP Data Protector does not verify the contents of files associated with the EXEC_CMD command, which allows remote attackers to execute arbitrary script code by providing this code with a trusted filename, as demonstrated by omni_chk_ds.sh.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Hp Dataprotector | — | Upgrade to the latest version of HP Data Protector and enable Encrypted Control Communications (ECC) services | Jul 2, 2015 | Feb 8, 2011 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub