HP Integrated Lights-Out Local Privilege Escalation and Information Disclosure Vulnerabilities

Bugtraq ID:	105425
Class:	Design Error
CVE:	CVE-2018-7105 CVE-2018-7106
Remote:	Yes
Local:	Yes
Published:	Sep 13 2018 12:00AM
Updated:	Sep 13 2018 12:00AM
Credit:	The vendor has reported these issues.
Vulnerable:	HP Integrated Lights-Out 5 0 HP Integrated Lights-Out 4 firmware 2.53 HP Integrated Lights-Out 4 firmware 2.50 HP Integrated Lights-Out 4 firmware 2.44 HP Integrated Lights-Out 4 firmware 2.22 HP Integrated Lights-Out 4 firmware 2.20 HP Integrated Lights-Out 4 firmware 2.03 HP Integrated Lights-Out 4 firmware 1.32 HP Integrated Lights-Out 4 firmware 1.30 HP Integrated Lights-Out 4 firmware 1.22 HP Integrated Lights-Out 4 firmware 1.13 HP Integrated Lights-Out 4 firmware 1.11 HP Integrated Lights-Out 4 firmware 2.10 HP Integrated Lights-Out 4 0 HP Integrated Lights-Out 3 0
Not Vulnerable:	HP Integrated Lights-Out 5 1.35 HP Integrated Lights-Out 4 firmware 2.61 HP Integrated Lights-Out 3 firmware 1.90

HP Integrated Lights-Out Local Privilege Escalation and Information Disclosure Vulnerabilities

HP Integrated Lights-Out is prone to local privilege escalation and information-disclosure vulnerabilities.

An attacker can exploit these issues to execute arbitrary code with elevated privileges and obtain sensitive information that may aid in launching further attacks.

HP Integrated Lights-Out Local Privilege Escalation and Information Disclosure Vulnerabilities

References:

• HP Homepage (HP)
  
• HPESBHF03866 rev.1 - HPE Integrated Lights-Out 3,4,5 using SSH, Remote Execution (HP)