HP StorageWorks Hidden Admin User Unauthorized Access Vulnerability

Bugtraq ID:	45386
Class:	Configuration Error
CVE:	CVE-2010-4115
Remote:	No
Local:	Yes
Published:	Dec 13 2010 12:00AM
Updated:	Dec 16 2010 03:04PM
Credit:	[email protected]
Vulnerable:	HP StorageWorks MSA2000 G3
Not Vulnerable:

HP StorageWorks Hidden Admin User Unauthorized Access Vulnerability

HP StorageWorks is prone to an unauthorized-access vulnerability.

An attacker can exploit this issue to access a user account with administrative permissions, which will facilitate a complete compromise of the affected device.

HP StorageWorks MSA2000 G3 is affected.

HP StorageWorks Hidden Admin User Unauthorized Access Vulnerability

Attackers need local access to the vulnerable device to exploit this issue.

HP StorageWorks Hidden Admin User Unauthorized Access Vulnerability

Solution:
The vendor released an update. Please see the references for details.

HP StorageWorks Hidden Admin User Unauthorized Access Vulnerability

References:

• HP StorageWorks (HP)
  
• HP StorageWorks Modular Smart Array P2000 G3, Remote Unauthorized Access ([email protected])
  
• hidden admin user on every HP MSA2000 G3 ([email protected] )
  
• Re: hidden admin user on every HP MSA2000 G3 ([email protected])