BID:10415

HP Integrated Lights Out Remote Denial of Service Vulnerability

Info

HP Integrated Lights Out Remote Denial of Service Vulnerability

Bugtraq ID:	10415
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2004-0525
Remote:	Yes
Local:	No
Published:	May 26 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	This issue was reported by the vendor.
Vulnerable:	HP Integrated Lights Out 1.51 A HP Integrated Lights Out 1.50 A HP Integrated Lights Out 1.50 HP Integrated Lights Out 1.42 A HP Integrated Lights Out 1.41 A HP Integrated Lights Out 1.40 A HP Integrated Lights Out 1.27 a HP Integrated Lights Out 1.26 a HP Integrated Lights Out 1.20 A HP Integrated Lights Out 1.16 A HP Integrated Lights Out 1.15 A HP Integrated Lights Out 1.15 HP Integrated Lights Out 1.10 HP Integrated Lights Out 1.6 A

Not Vulnerable:	HP Integrated Lights Out 1.55

Discussion

HP Integrated Lights Out Remote Denial of Service Vulnerability

HP Integrated Lights Out (iLO) is prone to a remote denial of service vulnerability when LAN management products use TCP port 0 to access the iLO service.

A successful attack can allow an attacker to cause the iLO service to crash, affectively denying service to legitimate users.

iLO firmware prior to versions 1.55 is prone to this vulnerability.

Exploit / POC

HP Integrated Lights Out Remote Denial of Service Vulnerability

No exploit is required.

Solution / Fix

HP Integrated Lights Out Remote Denial of Service Vulnerability

Solution:
HP has released a security bulletin (SSRT4724) to address this issue. Please see the referenced bulletin for more information.

HP Integrated Lights Out 1.10