U radu programskog paketa HP Database Archiving Software uočeni su sigurnosni propusti koje udaljeni napadač može iskoristiti za proizvoljno izvršavanje programskog koda.
Paket:
HP Database Archiving Software 6.x
Operacijski sustavi:
HP-UX 11.x
Kritičnost:
10
Problem:
nespecificirana pogreška
Iskorištavanje:
udaljeno
Posljedica:
proizvoljno izvršavanje programskog koda
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2011-4163, CVE-2011-4164, CVE-2011-4165
Izvorni ID preporuke:
HPSBMU02731
Izvor:
Hewlett Packard
Problem:
Otkrivene su potencijalne sigurnosne ranjivosti u navedenom programskom paketu. Nije poznat njihov uzrok.
Posljedica:
Udaljeni napadač može iskoristiti ranjivost za proizvoljno izvršavanje programskog koda.
Rješenje:
Svim se korisnicima savjetuje primjena nadogradnje.
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03128302
Version: 1
HPSBMU02731 SSRT100518 rev.1 - HP Database Archiving Software, Remote Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2011-12-22
Last Updated: 2011-12-22
Potential Security Impact: Remote execution of arbitrary code
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with HP Database Archiving Software. These vulnerabilities could be exploited remotely to execute arbitrary code.
References:
CVE-2011-4163 (ZDI-CAN-1213, SSRT100518)
CVE-2011-4164 (ZDI-CAN-1214, SSRT100519)
CVE-2011-4165 (ZDI-CAN-1263, SSRT100520)
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP Database Archiving Software v6.31
BACKGROUND
For a PGP signed version of this security bulletin please write to: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
CVSS 2.0 Base Metrics
Reference
Base Vector
Base Score
CVE-2011-4163
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
10.0
CVE-2011-4164
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
10.0
CVE-2011-4165
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
7.5
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
The Hewlett-Packard Company thanks AbdulAziz Hariri along with TippingPoint's Zero Day Initiative for reporting these vulnerabilities to Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite..
RESOLUTION
HP has made "DBARCH631_hotfix35 - platform independent HP Database Archiving software 6.31" available to resolve the vulnerabilities.
DBARCH631_hotfix35 is available by contacting the normal HP Services support channel.
MANUAL ACTIONS: Yes - NonUpdate
Install DBARCH631_hotfix35.
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS (for HP-UX)
For HP Database Archiving Software v6.31
HP-UX B.11.11
=============
action: install DBARCH631_hotfix35 if running HP Database Archiving Software v6.31
END AFFECTED VERSIONS (for HP-UX)
HISTORY
Version:1 (rev.1) - 22 December 2011 Initial release
Posljednje sigurnosne preporuke