Software Engineering Institute

CWE-306: Missing Authentication for Critical Function - CVE-2016-2004

Data Protector does not authenticate users, even with Encrypted Control Communications enabled. An unauthenticated remote attacker may be able to execute code on the server hosting Data Protector.

CWE-321: Use of Hard-coded Cryptographic Key

Data Protector contains an embedded SSL private key. This private key appears to be shared among all installations of Data Protector.

Data Protector versions 7, 8, and 9 are affected; other versions may also be impacted.

An unauthenticated remote attacker may be able to execute code on the server, or perform man-in-the-middle attacks against the server.

Apply an update

HP has released updates to Data Protector version 7, 8, and 9 to address these issues.

Affected users may consider the following workaround:

Restrict Network Access

As a general good security practice, only allow connections from trusted hosts and networks. Consult your firewall product's manual for more information.