U radu programskog paketa HP OA (HP Onboard Administrator) uočeno je više sigurnosnih ranjivosti. Udaljeni ih napadač može iskoristiti za otkrivanje i izmjenu osjetljivih podataka, napad uskraćivanjem usluga (DoS), preusmjeravanje URL adresa te dobivanje većih privilegija.
Paket:
HP Onboard Administrator 3.x
Operacijski sustavi:
HP Tru64 UNIX 4.x, HP Tru64 UNIX 5.x, HP-UX 10.x, HP-UX 11.x
Kritičnost:
7.6
Problem:
neodgovarajuća provjera ulaznih podataka, pogreška u programskoj komponenti
Sigurnosni propusti se javljaju zbog pogrešaka u komponenti "OpenSSL", neodgovarajuće provjere ulaznih podataka putem TLS (eng. Transport Layer Security) protokola, mogućnosti izmjene podataka u sjednici, itd.
Posljedica:
Udaljeni napadač naveden ranjivosti može iskoristiti za DoS (eng. Denial of Service) napad, dobivanje većih ovlasti u sustavu, otkrivanje i izmjenu podataka, te preusmjeravanje URL adresa.
Rješenje:
Svim se korisnicima navedenog programskog paketa savjetuje korištenje njegove najnovije inačice.
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03263573
Version: 1
HPSBMU02759 SSRT100817 rev.1 - HP Onboard Administrator (OA), Remote Unauthorized Access, Unauthorized Information Disclosure, Denial of Service (DoS), URL Redirection
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2012-04-02
Last Updated: 2012-04-02
Potential Security Impact: Remote unauthorized access, unauthorized information disclosure, Denial of Service (DoS), URL redirection
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with HP Onboard Administrator (OA). The vulnerabilities could be exploited remotely resulting in unauthorized access, unauthorized information disclosure, Denial of Service (DoS), and URL redirection.
References: CVE-2012-0128 (URL redirection), CVE-2012-0129 (unauthorized access), CVE-2012-0130 (unauthorized information disclosure), CVE-2010-4180, CVE-2009-3555, CVE-2008-7270
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP Onboard Administrator (OA) up to and including v3.32
BACKGROUND
For a PGP signed version of this security bulletin please write to: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
CVSS 2.0 Base Metrics
Reference
Base Vector
Base Score
CVE-2012-0128
(AV:N/AC:M/Au:N/C:P/I:P/A:N)
5.8
CVE-2012-0129
(AV:N/AC:H/Au:N/C:C/I:C/A:C)
7.6
CVE-2012-0130
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
5.0
CVE-2010-4180
AV:N/AC:M/Au:N/C:N/I:P/A:N)
4.3
CVE-2009-3555
(AV:N/AC:M/Au:N/C:N/I:P/A:P)
5.8
CVE-2008-7270
AV:N/AC:M/Au:N/C:N/I:P/A:N)
4.3
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
RESOLUTION
HP has made Onboard Administrator (OA) v3.50 or subsequent available to resolve the vulnerabilities.
Onboard Administrator (OA) v3.50 is available here:
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareIndex.jsp?lang=en&cc=us&prodNameId=3188475&prodTypeId=329290&prodSeriesId=3188465&swLang=8&taskId=135&swEnvOID=1113
HISTORY
Version:1 (rev.1) - 2 April 2012 Initial release
Posljednje sigurnosne preporuke