HP ProCurve Threat Management Services zl Module 'httpd' Denial of Service Vulnerability

Bugtraq ID:	35653
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2009-1425
Remote:	Yes
Local:	No
Published:	Jul 13 2009 12:00AM
Updated:	Jul 13 2009 09:36PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	HP ProCurve Threat Mgmt Services zl Module (J9155A) ST.1.0.090213
Not Vulnerable:	HP ProCurve Threat Mgmt Services zl Module (J9155A) ST.1.0.090603

HP ProCurve Threat Management Services zl Module 'httpd' Denial of Service Vulnerability

HP ProCurve Threat Management Services zl Module is prone to a denial-of-service vulnerability because the device's webserver fails to automatically restart if it is stopped.

An attacker may leverage this issue cause a denial of service to the device's management interface.

ProCurve Threat Management Services zl Module J9155A running vST.1.0.090213 firmware or prior is vulnerable.

HP ProCurve Threat Management Services zl Module 'httpd' Denial of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HP ProCurve Threat Management Services zl Module 'httpd' Denial of Service Vulnerability

Solution:
The vendor has released fixes. Please see the references for details.


HP ProCurve Threat Mgmt Services zl Module (J9155A) ST.1.0.090213

• HP ST.1.0.090603.zip
  http://www.procurve.com/software/downloads/LicenseInformation.aspx?fil eName=http://ftp.hp.com/pub/networking/software/ST.1.0.090603.zip

HP ProCurve Threat Management Services zl Module 'httpd' Denial of Service Vulnerability

References:

• HP ProCurve Threat Management Services zl Module (HP)
  
• [security bulletin] HPSBGN02446 SSRT090111 rev.1 - HP ProCurve Threat Management ([email protected])