HP Onboard Administrator Multiple Security Vulnerabilities

Bugtraq ID:	52862
Class:	Design Error
CVE:	CVE-2012-0128 CVE-2012-0129 CVE-2012-0130
Remote:	Yes
Local:	No
Published:	Apr 03 2012 12:00AM
Updated:	Apr 03 2012 12:00AM
Credit:	The vendor reported these issues.
Vulnerable:	HP Onboard Administrator 3.32 HP Onboard Administrator 3.31 HP Onboard Administrator 3.21
Not Vulnerable:

HP Onboard Administrator Multiple Security Vulnerabilities

HP Onboard Administrator is prone to the following security vulnerabilities:

1. A URI-redirection vulnerability
2. An information-disclosure vulnerability
3. A security-bypass vulnerability

An attacker may exploit these issues to obtain sensitive information, bypass certain security restrictions, and redirect a user to a potentially malicious site; this may aid in phishing attacks.

HP Onboard Administrator versions up to and including 3.31 are affected.

HP Onboard Administrator Multiple Security Vulnerabilities

Attackers can exploit these issues using browser and the URI-redirection issue can be exploited by enticing an unsuspecting victim to follow a malicious URI.

HP Onboard Administrator Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

HP Onboard Administrator Multiple Security Vulnerabilities

References:

• HP Onboard Administrator Homepage (HP)
  
• HPSBMU02759 SSRT100817 rev.1 - HP Onboard Administrator (OA), Remote Unauthorize (HP)