HP StorageWorks Command View XP Unspecified Access Restriction Bypass Vulnerability

Bugtraq ID:	11249
Class:	Access Validation Error
CVE:	CVE-2004-1480
Remote:	No
Local:	Yes
Published:	Sep 24 2004 12:00AM
Updated:	Jul 12 2009 07:06AM
Credit:	This vulnerability was disclosed by the vendor.
Vulnerable:	HP StorageWorks Command View XP 1.60 .00 HP StorageWorks Command View XP 1.53 .05a HP StorageWorks Command View XP 1.53 .01a HP StorageWorks Command View XP 1.53 .00 HP StorageWorks Command View XP 1.52 .00 HP StorageWorks Command View XP 1.51 .00 HP StorageWorks Command View XP 1.40 .04 HP StorageWorks Command View XP 1.40 .01 HP StorageWorks Command View XP 1.30 .00 HP StorageWorks Command View XP 1.11.1 HP StorageWorks Command View XP 1.11 .02 HP StorageWorks Command View XP 1.11 HP StorageWorks Command View XP 1.8 B HP StorageWorks Command View XP 1.8 A HP StorageWorks Command View XP 1.8 HP StorageWorks Command View XP 1.7 B HP StorageWorks Command View XP 1.7 A
Not Vulnerable:

HP StorageWorks Command View XP Unspecified Access Restriction Bypass Vulnerability

It is reported that HP StorageWorks Command View XP contains an access restriction bypass vulnerability. Specific details were not provided.

Reportedly, local attackers using the Command View XP software can bypass access restrictions to perform actions not authorized to them. This vulnerability is reported to only affect local use of the software from the management station, and not from either the web interface, or the command line interface.

All versions up to, and including version 1.8B of Command View XP on management stations included in the following devices are reported to be affected by this vulnerability:
- StorageWorks Disk Array XP48
- StorageWorks Disk Array XP128
- Surestore Disk Array XP256
- StorageWorks Disk Array XP1024

HP StorageWorks Command View XP Unspecified Access Restriction Bypass Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HP StorageWorks Command View XP Unspecified Access Restriction Bypass Vulnerability

Solution:
The vendor has released an advisory (SSRT4794 rev.0) along with fixes to address this issue. Affected users with an ITRC account should see the referenced advisory for information on obtaining fixes. Users unable to access the advisory should contact the vendor for further information.

HP StorageWorks Command View XP Unspecified Access Restriction Bypass Vulnerability

References:

• HP IT Resource Center (for Europe) (HP IT Resource Center)
  
• HP IT Resource Center (for US, Canada, Asia-Pacific, & Latin-America) (HP IT Resource Center)
  
• SSRT4794 - HP StorageWorks Command View XP access restriction bypass (HP)