U radu programskog paketa HP Network Automation, za operacijske sustave Linux, Solaris i Windows, uočen je sigurnosni nedostatak. Moguće ga je iskoristiti udaljeno, za zaobilaženje sigurnosnih ograničenja i neovlašteni pristup sustavu.

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c03171149

Version: 1
HPSBMU02738 SSRT100748 rev.1 - HP Network Automation Running on Linux, Solaris, and Windows, Remote Unauthorized Access
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2012-01-30

Last Updated: 2012-01-30

Potential Security Impact: Remote unauthorized access

Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY

A potential security vulnerability has been identified with HP Network Automation running on Linux, Solaris, and Windows. The vulnerability could be exploited remotely to gain unauthorized access.

References: CVE-2011-4790
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

HP Network Automation v7.5x, v7.6x, v9.0, v9.10
BACKGROUND

For a PGP signed version of this security bulletin please write to: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.

CVSS 2.0 Base Metrics
Reference
	
Base Vector
	
Base Score
CVE-2011-4790
	
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
	
9.3

Information on CVSS is documented in HP Customer Notice: HPSN-2008-002
RESOLUTION

HP has provided a patch to resolve the vulnerability for HP Network Automation v9.10. The patch is available here: http://support.openview.hp.com/selfsolve/patches

    Upgrade to HP Network Automation v9.10
    Apply patch 2 or subsequent (Network Automation 09.10.02, NA_00015)

HISTORY
Version:1 (rev.1) - 30 January 2012 Initial Release