Directory traversal vulnerability in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 al

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• hp openview storage data protector6.00
• hp openview storage data protector6.10
• hp openview storage data protector6.11

Other highest-scoring records for the same primary product.

• CVE-2011-1865Multiple stack-based buffer overflows in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allow remote attackers to
  67This week
• CVE-2007-2280Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenV
  58Plan
• CVE-2011-1732Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows r
  47Plan
• CVE-2011-1866Buffer overflow in omniinet.exe in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to execu
  46Plan
• CVE-2011-1735Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows r
  44Plan
• CVE-2011-1734Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows r
  44Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.