----------------------------------------------------------------------

Secunia Network Software Inspector 2.0 (NSI) - Public Beta

The Public Beta has ended. Thanks to all that participated.

Learn more:
http://secunia.com/network_software_inspector_2/

----------------------------------------------------------------------

TITLE:
EMC AlphaStor Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA30410

VERIFY ADVISORY:
http://secunia.com/advisories/30410/

CRITICAL:
Moderately critical

IMPACT:
System access

WHERE:
>From local network

SOFTWARE:
EMC AlphaStor 3.x
http://secunia.com/product/18816/

DESCRIPTION:
Some vulnerabilities have been reported in EMC AlphaStor, which can
be exploited by malicious people to compromise a vulnerable system.

1) Multiple boundary errors within the AlphaStor Command Line
Interface process of the Server Agent can be exploited to cause
stack-based buffer overflows via specially crafted packets sent to
default port 41025/TCP.

Successful exploitation allows execution of arbitrary code.

2) An input validation error in the "robotd" process of the Library
Manager can be exploited to execute arbitrary programs on the system
via a specially crafted packet sent to default port 3500/TCP.

The vulnerabilities are reported in version 3.1 SP1 for Windows.
Other versions may also be affected.

SOLUTION:
The vendor has issued updates. Contact EMC Software Technical Support
or refer to knowledge base article emc186391:
https://powerlink.emc.com

PROVIDED AND/OR DISCOVERED BY:
1) Discovered by:
* Stephen Fewer of Harmony Security, reported via iDefense Labs
* Sean Larsson, iDefense Labs
2) Stephen Fewer of Harmony Security, reported via iDefense Labs

ORIGINAL ADVISORY:
iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=702
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=703

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------