HP Procurve 4000M Switch Device Reset Denial Of Service Vulnerability
BID:5784
Info
HP Procurve 4000M Switch Device Reset Denial Of Service Vulnerability
| Bugtraq ID: | 5784 |
| Class: | Access Validation Error |
| CVE: |
CVE-2002-1147 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 24 2002 12:00AM |
| Updated: | Jul 11 2009 05:06PM |
| Credit: | Discovery credited to Brook Powers and Tony Kapela. |
| Vulnerable: |
HP Procurve Switch 8000M HP Procurve Switch 4000M HP Procurve Switch 2424M HP Procurve Switch 2400M 0 HP Procurve Switch 2400M HP Procurve Switch 1600M |
| Not Vulnerable: | |
Discussion
HP Procurve 4000M Switch Device Reset Denial Of Service Vulnerability
When multiple Procurve switches are used interconnected, it is common for an administrator to enable a feature allowing each switch to be viewed through a single interface, accessible via the web.
It has been reported that HP Procurve Switches are vulnerable to a denial of service attack, when used in a "stack" configuration. It is possible for an attacker to reset member switches by issuing a device reset command to a vulnerable device. Vulnerable devices do not require authentication before accepting this command.
It should be noted that the web interface is not enabled by default.
When multiple Procurve switches are used interconnected, it is common for an administrator to enable a feature allowing each switch to be viewed through a single interface, accessible via the web.
It has been reported that HP Procurve Switches are vulnerable to a denial of service attack, when used in a "stack" configuration. It is possible for an attacker to reset member switches by issuing a device reset command to a vulnerable device. Vulnerable devices do not require authentication before accepting this command.
It should be noted that the web interface is not enabled by default.
Exploit / POC
HP Procurve 4000M Switch Device Reset Denial Of Service Vulnerability
This issue can be exploited with a web browser.
The following proof of concept has been supplied by Brook Powers:
http://<IP ADDRESS>/sw2/cgi/device_reset?
This issue can be exploited with a web browser.
The following proof of concept has been supplied by Brook Powers:
http://<IP ADDRESS>/sw2/cgi/device_reset?
Solution / Fix
HP Procurve 4000M Switch Device Reset Denial Of Service Vulnerability
Solution:
HP has issued an advisory. A temporary fix is available for download. The file, C_09_16.swi is available for download at the following location.
ftp://procurve:[email protected]/
or: ftp://procurve:[email protected]/
file: C_09_16.swi
It should be noted that this is a temporary file and will be removed when a product upgrade is available. Further information is available in the referenced advisory.
HP Procurve Switch 2400M 0
HP Procurve Switch 2424M
HP Procurve Switch 4000M
HP Procurve Switch 2400M
HP Procurve Switch 1600M
HP Procurve Switch 8000M
Solution:
HP has issued an advisory. A temporary fix is available for download. The file, C_09_16.swi is available for download at the following location.
ftp://procurve:[email protected]/
or: ftp://procurve:[email protected]/
file: C_09_16.swi
It should be noted that this is a temporary file and will be removed when a product upgrade is available. Further information is available in the referenced advisory.
HP Procurve Switch 2400M 0
-
HP C_09_16.swi
ftp://procurve:[email protected]/
HP Procurve Switch 2424M
-
HP C_09_16.swi
ftp://procurve:[email protected]/
HP Procurve Switch 4000M
-
HP C_09_16.swi
ftp://procurve:[email protected]/
HP Procurve Switch 2400M
-
HP C_09_16.swi
ftp://procurve:[email protected]/
HP Procurve Switch 1600M
-
HP C_09_16.swi
ftp://procurve:[email protected]/
HP Procurve Switch 8000M
-
HP C_09_16.swi
ftp://procurve:[email protected]/
References
HP Procurve 4000M Switch Device Reset Denial Of Service Vulnerability
References:
References: