HP Integrated Lights-Out CVE-2017-12542 Multiple Unspecified Security Vulnerabilities

Bugtraq ID:	100467
Class:	Unknown
CVE:	CVE-2017-12542
Remote:	Yes
Local:	No
Published:	Aug 24 2017 12:00AM
Updated:	Aug 24 2017 12:00AM
Credit:	Fabien Perigaud of Airbus Defense and Space CyberSecurity.
Vulnerable:	HP Integrated Lights-Out 4 firmware 2.50 HP Integrated Lights-Out 4 firmware 2.44 HP Integrated Lights-Out 4 firmware 2.22 HP Integrated Lights-Out 4 firmware 2.20 HP Integrated Lights-Out 4 firmware 2.03 HP Integrated Lights-Out 4 firmware 1.32 HP Integrated Lights-Out 4 firmware 1.30 HP Integrated Lights-Out 4 firmware 1.22 HP Integrated Lights-Out 4 firmware 1.13 HP Integrated Lights-Out 4 firmware 1.11 HP Integrated Lights-Out 4 firmware 2.10
Not Vulnerable:	HP Integrated Lights-Out 4 firmware 2.53

HP Integrated Lights-Out CVE-2017-12542 Multiple Unspecified Security Vulnerabilities

HP Integrated Lights-Out is prone to following security vulnerabilities:

1. An unspecified remote code-execution vulnerability
2. An unspecified authentication-bypass vulnerability

An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application,bypass security restrictions, or execute arbitrary code.

HP Integrated Lights-Out 4 (iLO 4) versions prior to 2.53 are vulnerable.

HP Integrated Lights-Out CVE-2017-12542 Multiple Unspecified Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HP Integrated Lights-Out CVE-2017-12542 Multiple Unspecified Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

HP Integrated Lights-Out CVE-2017-12542 Multiple Unspecified Security Vulnerabilities

References:

• HP Homepage (HP)
  
• HPESBHF03769 rev.1 - HPE Integrated Lights-out 4 (iLO 4) Multiple Remote Vulnera (HP)