HP Operations Manager Default Manager Account Remote Security Vulnerability

Bugtraq ID:	36253
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 03 2009 12:00AM
Updated:	Nov 30 2009 10:25PM
Credit:	Intevydis
Vulnerable:	HP Operations Manager 8.1
Not Vulnerable:

HP Operations Manager Default Manager Account Remote Security Vulnerability

HP Operations Manager is prone to a remote security vulnerability.

Operations Manager 8.1 for Windows is vulnerable; other versions may also be vulnerable.

NOTE: This issue may be related to the issue documented in BID 37086 (HP Operations Manager Remote Unauthorized Access Vulnerability), but this has not been confirmed.

HP Operations Manager Default Manager Account Remote Security Vulnerability

A working commercial exploit is available through Intevydis.

Attackers can exploit this issue using readily available tools. The following authentication credentials are available:

ovwebusr:OvW*busr1

HP Operations Manager Default Manager Account Remote Security Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HP Operations Manager Default Manager Account Remote Security Vulnerability

References:

• HP bugs (Intevydis)
  
• Operations Manager Homepage (HP)
  
• VulnDisco Pack Professional (Intevydis)