CVE-2011-0924: Input Validation
The client in HP Data Protector does not verify the contents of files associated with the EXECCMD command, which allows remote attackers to execute arbitrary script code by providing this code with a trusted filename, as demonstrated by omnichkds.sh.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0924?
CVE-2011-0924 has a medium severity rating due to the potential for arbitrary code execution by remote attackers.
How do I fix CVE-2011-0924?
To fix CVE-2011-0924, ensure you are using an updated version of HP Data Protector that addresses this vulnerability.
What are the potential impacts of CVE-2011-0924?
The potential impacts of CVE-2011-0924 include unauthorized remote code execution, which can lead to data breaches and system compromise.
Who is affected by CVE-2011-0924?
Users of HP Data Protector are affected by CVE-2011-0924 if they have not implemented the necessary security updates.
What exploit methods are used in CVE-2011-0924?
CVE-2011-0924 can be exploited by providing arbitrary script code with a trusted filename related to the EXEC_CMD command.