Otkriveni su višestruki sigurnosni propusti u radu programskog paketa HP Network Node Manager i. Napadaču omogućuju izvođenje DoS napada, pokretanje proizvoljnog programskog koda, stjecanje većih ovlasti te zaobilaženje pojedinih ograničenja.
Paket:
HP Network Node Manager i (NNMi) 8.x, HP Network Node Manager i (NNMi) 9.x
Operacijski sustavi:
HP-UX 11.x, Microsoft Windows Server 2008, Sun Solaris 10, SUSE Linux Enterprise Server (SLES) 11
Kritičnost:
6.9
Problem:
cjelobrojno prepisivanje, nespecificirana pogreška, pogreška u programskoj funkciji, pogreška u programskoj komponenti, preljev međuspremnika
Bitniji su propusti posljedica prepisivanja spremnika u funkcijama "HsbParser.getSoundBank", "setDiffICM", "setBytePixels", cjelobrojnog prepisivanja u "JPEGImageReader" implementaciji, višestrukih nespecificiranih pogrešaka, itd. Za uvid u sve propuste preporuča se čitanje izvornog upozorenja.
Posljedica:
Napadač ih može iskoristiti za izvođenje DoS napada, pokretanje proizvoljnog programskog koda, stjecanje većih ovlasti te zaobilaženje pojedinih ograničenja.
Rješenje:
Korisnicima se savjetuje instalacija odgovarajućih programskih ispravki.
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03005726
Version: 1
HPSBMU02703 SSRT100242 rev.1 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Denial of Service (DoS), Unauthorized Disclosure of Information, Unauthorized Modification
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2011-09-12
Last Updated: 2011-09-12
Potential Security Impact: Remote Denial of Service (DoS), unauthorized disclosure of information, unauthorized modification
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows. The vulnerabilities could be remotely exploited resulting in Denial of Service (DoS), unauthorized disclosure of information, and unauthorized modification.
References: CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP Network Node Manager i (NNMi) v8.1x and v9.0x for HP-UX, Linux, Solaris, and Windows
BACKGROUND
For a PGP signed version of this security bulletin please write to: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
CVSS 2.0 Base Metrics
Reference
Base Vector
Base Score
CVE-2009-3867
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
9.3
CVE-2009-3868
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
9.3
CVE-2009-3869
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
9.3
CVE-2009-3871
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
9.3
CVE-2009-3872
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
9.3
CVE-2009-3873
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
9.3
CVE-2009-3874
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
9.3
CVE-2009-3875
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
5.0
CVE-2009-3876
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
5.0
CVE-2009-3877
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
5.0
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
RESOLUTION
HP has made a hotfixes available to resolve these vulnerabilities for NNMi v9.0x and NNMi v8.1x. The hotfixes can be obtained by contacting the normal HP Services support channel.
For NNMi 9.0x
Operating System
Hotfix Identifier
HP-UX
QCCR1B90090
Linux
QCCR1B90091
Solaris
QCCR1B90092
Windows
QCCR1B90093
NNMi v9.0x Required Patches
Note: Before installing the hotfix on NNMi v9.0x insure that the following patches have been installed.
Operating System
Patch
HP-UX
PHSS_41982
Linux
NNM900L_00004
Solaris
NNM900S_00004
Windows
NNM900W_00004
For NNMi 8.1x
NNMi Version
Hotfix Identifier
NNMi v8.1x
QCCR1B45223
NNMi v8.1x Required Patches
Note: Before installing the hotfix on NNMi v8.1x insure that the following patches have been installed.
Operating System
Patch
HP-UX
PHSS_41147
Linux
NNM810L_00009
Solaris
NNM810S_00009
Windows
NNM810W_00009
MANUAL ACTIONS: Yes - NonUpdate
Install appropriate hotfix after installing the required patch.
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS (for HP-UX)
For HP-UX NNMi v9.0x
HP-UX B.11.31
HP-UX B.11.23 (IA)
=============
HPOvNNM.HPNMSJBOSS
action: install the QCCR1B90090 hotfix after installing the required patch
For HP-UX NNMi v8.1x
HP-UX B.11.31
HP-UX B.11.23 (IA)
=============
HPOvNNM.HPNMSJBOSS
action: install the QCCR1B45223 hotfix after installing the required patch
END AFFECTED VERSIONS (for HP-UX)
HISTORY
Version:1 (rev.1) - 12 September 2011 Initial release
Posljednje sigurnosne preporuke