HP ProCurve Switch Denial of Service Vulnerability

Bugtraq ID:	9103
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Nov 26 2003 12:00AM
Updated:	Nov 26 2003 12:00AM
Credit:	The disclosure of this issue has been credited to the vendor.
Vulnerable:	HP ProCurve Switch 5372XL J4848A HP ProCurve Switch 5348XL J4849A HP ProCurve Switch 5308XL J4819A HP ProCurve Switch 5304XL J4850A
Not Vulnerable:

HP ProCurve Switch Denial of Service Vulnerability

It has been reported that HP ProCurve Switches are prone to a denial of service condition when faced with RCP worms such as W32.Welchia.Worm (MCID 1811) and W32.Blaster.Worm (MCID 1761). This issue is reported to result in deteriorated network traffic and a denial of service condition for end users.

HP ProCurve Switch Denial of Service Vulnerability

This issue is affected by known RPC worms including W32.Welchia.Worm (MCID 1811) and W32.Blaster.Worm (MCID 1761) that exploit Microsoft Windows ntdll.dll Buffer Overflow Vulnerability (BID 7116) and Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (BID 8205). These worms and associated exploits are currently in the wild.

HP ProCurve Switch Denial of Service Vulnerability

Solution:
HP has released and advisory HPSBMI0311-006 to address this issue. Users are advised to upgrade to versions E.07.40 or subsequent.

HP ProCurve Switch Denial of Service Vulnerability

References: