HP Operations Manager Remote Unauthorized Access Vulnerability
BID:37086
Info
HP Operations Manager Remote Unauthorized Access Vulnerability
| Bugtraq ID: | 37086 |
| Class: | Configuration Error |
| CVE: |
CVE-2009-3843 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 18 2009 12:00AM |
| Updated: | Dec 21 2009 08:53PM |
| Credit: | Stephen Fewer of Harmony Security |
| Vulnerable: |
HP Operations Manager 8.1 |
| Not Vulnerable: | |
Discussion
HP Operations Manager Remote Unauthorized Access Vulnerability
HP Operations Manager is prone to a remote unauthorized-access vulnerability.
An attacker can exploit this issue to upload and execute arbitrary code with SYSTEM-level permissions, which will facilitate a complete compromise of the affected computer.
Operations Manager 8.1 for Windows is vulnerable; other versions may also be vulnerable.
HP Operations Manager is prone to a remote unauthorized-access vulnerability.
An attacker can exploit this issue to upload and execute arbitrary code with SYSTEM-level permissions, which will facilitate a complete compromise of the affected computer.
Operations Manager 8.1 for Windows is vulnerable; other versions may also be vulnerable.
Exploit / POC
HP Operations Manager Remote Unauthorized Access Vulnerability
Attackers can use readily available tools to exploit this issue.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
Attackers can use readily available tools to exploit this issue.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
HP Operations Manager Remote Unauthorized Access Vulnerability
Solution:
Vendor updates are available. Please see the references for details.
HP Operations Manager 8.1
Solution:
Vendor updates are available. Please see the references for details.
HP Operations Manager 8.1
-
HP OMW_00032
http://support.openview.hp.com/selfsolve/patches
References
HP Operations Manager Remote Unauthorized Access Vulnerability
References:
References: