----------------------------------------------------------------------

Want a new job?

http://secunia.com/secunia_security_specialist/
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

International Partner Manager - Project Sales in the IT-Security
Industry:
http://corporate.secunia.com/about_secunia/64/

----------------------------------------------------------------------

TITLE:
EMC Retrospect Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA31186

VERIFY ADVISORY:
http://secunia.com/advisories/31186/

CRITICAL:
Less critical

IMPACT:
Brute force, Exposure of sensitive information, DoS

WHERE:
>From local network

SOFTWARE:
EMC Retrospect 7.x
http://secunia.com/product/7429/
EMC Retrospect Client for Windows 7.x
http://secunia.com/product/8531/

DESCRIPTION:
Some vulnerabilities and a security issue has been reported in EMC
Retrospect, which can be exploited by malicious people to disclose
sensitive information or cause a DoS (Denial of Service).

1) An error in retroclient.exe can be exploited to cause the process
to terminate via specially crafted packets sent to default port
497/TCP.

2) A NULL pointer dereference error can be exploited to cause a DoS
via specially crafted packets sent to default port 497/TCP.

3) It is possible to disclose e.g. the password hash in plaintext via
a specially crafted packet sent to the EMC Retrospect Client.
Additionally, the authentication module of the EMC Retrospect Server
reportedly uses a weak password hash arithmetic, which can be
brute-forced.

The vulnerabilities and security issue are reported in version
7.5.116 (Client) and 7.5.508 (Server).

SOLUTION:
Update to the latest versions.
http://www.emcinsignia.com/updates

PROVIDED AND/OR DISCOVERED BY:
Zhenhua Liu, Fortinet's FortiGuard Global Security Research Team

ORIGINAL ADVISORY:
Fortinet:
http://www.fortiguardcenter.com/advisory/FGA-2008-16.html
http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063354.html
http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063353.html
http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063351.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------