-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                          ESB-2008.0722 -- [Win]
     Multiple vulnerabilities in EMC Dantz Retrospect 7 Backup Client
                               28 July 2008

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              EMC Dantz Retrospect 7 Backup Client
Publisher:            Fortinet
Operating System:     Windows
Impact:               Access Privileged Data
                      Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-3290 CVE-2008-3289 CVE-2008-3288
                      CVE-2008-3287

Original Bulletin:
  http://www.fortiguardcenter.com/advisory/FGA-2008-16.html

Comment: Note that there are three Fortinet bulletins in this advisory.

Revision History:     July 28 2008: Added CVE information
                      July 22 2008: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

FGA-2008-16: EMC Dantz Retrospect 7 backup Client PlainText Password Hash
Disclosure Vulnerability
http://www.fortiguardcenter.com/advisory/FGA-2008-16.html
July 20, 2008

- -- Affected Vendors:
EMC

- -- Affected Products:
EMC Dantz Retrospect 7 backup Client 7.5.116

- -- Vulnerability Details:

The transfer of Password Hash of EMC Dantz Retrospect 7 backup Client in
the network is plaintext.
By sending a malicious packet to the client, client will send back lots
information including Password Hash resulting in a loss of
confidentiality.

What is more, EMC Dantz Retrospect 7 backup server's authentication module
using weak password hash arithmetic,
By buteforce it attacker can gain full control of client's machine


- -- Vendor Response:
EMC has issued an update to correct this vulnerability:

http://www.emcinsignia.com/updates

- -- Disclosure Timeline:
2008-04-20 - Vulnerability reported to vendor
2008-06-30 - Vendor issued update
2088-07-20 - Coordinated public release of advisory

Acknowledgment:

Zhenhua Liu of Fortinet's FortiGuard Global Security Research Team


Disclaimer:

Although Fortinet has attempted to provide accurate information in these
materials, Fortinet assumes no legal responsibility for the accuracy or
completeness of the information. More specific information is available on
request from Fortinet. Please note that Fortinet's product information
does not constitute or contain any guarantee, warranty or legally binding
representation, unless expressly identified as such in a duly signed
writing.

About Fortinet ( www.fortinet.com ):

Fortinet is the pioneer and leading provider of ASIC-accelerated unified
threat management, or UTM, security systems, which are used by enterprises
and service providers to increase their security while reducing total
operating costs. Fortinet solutions were built from the ground up to
integrate multiple levels of security protection--including firewall,
antivirus, intrusion prevention, VPN, spyware prevention and anti-spam --
designed to help customers protect against network and content level
threats. Leveraging a custom ASIC and unified interface, Fortinet
solutions offer advanced security functionality that scales from remote
office to chassis-based solutions with integrated management and
reporting. Fortinet solutions have won multiple awards around the world
and are the only security products that are certified in six programs by
ICSA Labs: (Firewall, Antivirus, IPSec, SSL, Network IPS, and
Anti-Spyware). Fortinet is privately held and based in Sunnyvale,
California.

- -----------------------------------------------------------------------

FGA-2008-16: EMC Dantz Retrospect 7 backup Client 7.5.116 NULL-Pointer
reference Denial of Service Vulnerability
http://www.fortiguardcenter.com/advisory/FGA-2008-16.html
July 20, 2008

- -- Affected Vendors:
EMC

- -- Affected Products:
EMC Dantz Retrospect 7 backup Client 7.5.116

- -- Vulnerability Details:

There exists vulnerability in EMC's Retrospect Client 7.5.116. which
allows remote attackers to cause a Read Access violation,
(Client termination and loss of backup service) via malformed packets to
TCP port 497, which triggers an assert error.
This is a designed error of EMC Dantz: Using a NULL-Pointer reference by
mistake.

- -- Vendor Response:
EMC has issued an update to correct this vulnerability:

http://www.emcinsignia.com/updates

- -- Disclosure Timeline:
2008-04-20 - Vulnerability reported to vendor
2008-06-30 - Vendor issued update
2088-07-20 - Coordinated public release of advisory

Acknowledgment:

Zhenhua Liu of Fortinet's FortiGuard Global Security Research Team


Disclaimer:

Although Fortinet has attempted to provide accurate information in these
materials, Fortinet assumes no legal responsibility for the accuracy or
completeness of the information. More specific information is available on
request from Fortinet. Please note that Fortinet's product information
does not constitute or contain any guarantee, warranty or legally binding
representation, unless expressly identified as such in a duly signed
writing.

About Fortinet ( www.fortinet.com ):

Fortinet is the pioneer and leading provider of ASIC-accelerated unified
threat management, or UTM, security systems, which are used by enterprises
and service providers to increase their security while reducing total
operating costs. Fortinet solutions were built from the ground up to
integrate multiple levels of security protection--including firewall,
antivirus, intrusion prevention, VPN, spyware prevention and anti-spam --
designed to help customers protect against network and content level
threats. Leveraging a custom ASIC and unified interface, Fortinet
solutions offer advanced security functionality that scales from remote
office to chassis-based solutions with integrated management and
reporting. Fortinet solutions have won multiple awards around the world
and are the only security products that are certified in six programs by
ICSA Labs: (Firewall, Antivirus, IPSec, SSL, Network IPS, and
Anti-Spyware). Fortinet is privately held and based in Sunnyvale,
California.

- ----------------------------------------------------------------------

FGA-2008-16: EMC Dantz Retrospect 7 backup Client 7.5.116 Remote Memory
corruption Vulnerability
http://www.fortiguardcenter.com/advisory/FGA-2008-16.html
July 20, 2008

- -- Affected Vendors:
EMC

- -- Affected Products:
EMC Dantz Retrospect 7 backup Client 7.5.116

- -- Vulnerability Details:

The retroclient.exe process listens, in a default configuration, on TCP
port 497.
When Continued sending packets with length of 2064 bytes and filling with
0x00,
about 30 seconds to 5 minutes the status box shows: ¡°Client networking
not available, or service not running¡± , keep on sending packets and few
times later retroclient.exe process terminate, backup service lost, TCP
port 497 closed .


- -- Vendor Response:
EMC has issued an update to correct this vulnerability:

http://www.emcinsignia.com/updates

- -- Disclosure Timeline:
2008-04-20 - Vulnerability reported to vendor
2008-06-30 - Vendor issued update
2088-07-20 - Coordinated public release of advisory

Acknowledgment:

Zhenhua Liu of Fortinet's FortiGuard Global Security Research Team


Disclaimer:

Although Fortinet has attempted to provide accurate information in these
materials, Fortinet assumes no legal responsibility for the accuracy or
completeness of the information. More specific information is available on
request from Fortinet. Please note that Fortinet's product information
does not constitute or contain any guarantee, warranty or legally binding
representation, unless expressly identified as such in a duly signed
writing.

About Fortinet ( www.fortinet.com ):

Fortinet is the pioneer and leading provider of ASIC-accelerated unified
threat management, or UTM, security systems, which are used by enterprises
and service providers to increase their security while reducing total
operating costs. Fortinet solutions were built from the ground up to
integrate multiple levels of security protection--including firewall,
antivirus, intrusion prevention, VPN, spyware prevention and anti-spam --
designed to help customers protect against network and content level
threats. Leveraging a custom ASIC and unified interface, Fortinet
solutions offer advanced security functionality that scales from remote
office to chassis-based solutions with integrated management and
reporting. Fortinet solutions have won multiple awards around the world
and are the only security products that are certified in six programs by
ICSA Labs: (Firewall, Antivirus, IPSec, SSL, Network IPS, and
Anti-Spyware). Fortinet is privately held and based in Sunnyvale,
California.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBSI0P9Ch9+71yA2DNAQLdcwP+J+J7uiFuJdFyBpR6diQaFlqmFSBobbgk
VVX6C23dswQyqcx+j2vWDuW7avsq8YrhesCyJCbt2cTg7xfEiR/Lxo6L8xnjDz6j
CrUCAsWIhjYeAd7dDsXE5bqnMV9ZOUZ0WuKT7j5bdjR2UFdhUEH4h5pQ8pT3n3Ej
QeGvH4y9ajg=
=CGlN
-----END PGP SIGNATURE-----