Vulnerability in EMC Data Protection Advisor

CVE-2012-0406

The DPA_Utilities.cProcessAuthenticationData function in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an AUTHENTICATECONNECTION command that (1) lacks a password field or (2) has an empty password.

EPSS: 0.086 (94.5th percentile) — read the EPSS interpretation.

Affected products

Emc Data_protection_advisor — versions 5.5, 5.6, 5.7
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

security_alert@emc.com (mailing-list, x_refsource_BUGTRAQ)
security_alert@emc.com (exploit, x_refsource_EXPLOIT-DB)
security_alert@emc.com (vdb-entry, x_refsource_SECTRACK)
security_alert@emc.com (Exploit, x_refsource_MISC)