HP StorageWorks Products Remote Management Interface Privilege Escalation Vulnerability

Bugtraq ID:	36388
Class:	Unknown
CVE:	CVE-2009-2680
Remote:	Yes
Local:	No
Published:	Sep 14 2009 12:00AM
Updated:	Jan 12 2010 03:41PM
Credit:	Alexander Polyakov
Vulnerable:	HP StorageWorks MSL8096 Tape Library firmware 8.90 HP StorageWorks MSL4048 Tape Library firmware 6.50 HP StorageWorks MSL2024 Tape Library firmware 4.20 HP StorageWorks 1/8 G2 Tape Autoloader firmware 2.30
Not Vulnerable:	HP StorageWorks MSL8096 Tape Library firmware 9.10 HP StorageWorks MSL4048 Tape Library firmware 6.70 HP StorageWorks MSL2024 Tape Library firmware 4.40 HP StorageWorks 1/8 G2 Tape Autoloader firmware 2.50

HP StorageWorks Products Remote Management Interface Privilege Escalation Vulnerability

HP StorageWorks products are prone to a privilege-escalation vulnerability in the Remote Management Interface.

This issue affects the following:

HP StorageWorks 1/8 G2 Tape Autoloader firmware 2.30 and earlier
HP StorageWorks MSL2024 Tape Library firmware 4.20 and earlier
HP StorageWorks MSL4048 Tape Library firmware 6.50 and earlier
HP StorageWorks MSL8096 Tape Library firmware 8.90 and earlier

HP StorageWorks Products Remote Management Interface Privilege Escalation Vulnerability

An attacker can exploit this issue via a browser.

HP StorageWorks Products Remote Management Interface Privilege Escalation Vulnerability

Solution:
The vendor has released updates. Please see the references for details.

HP StorageWorks Products Remote Management Interface Privilege Escalation Vulnerability

References:

• [DSECRG-09-011] HP StorageWorks 1/8 G2 Tape Autoloader - privilege escalation, D (Digital Security)
  
• HP StorageWorks Product page (HP)
  
• HPSBST02459 SSRT080134 (HP)