PT-2007-6450 · Hewlett Packard · Hp Openview Configuration Management (Cm) Infrastructure+1

Publicado 2007-10-29 · Atualizado 2018-10-15 · CVE-2007-5413

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Hewlett-Packard (HP) OpenView Configuration Management (CM) Infrastructure versions 4.0 through 4.2i Hewlett-Packard (HP) Client Configuration Manager (CCM) version 2.0

Description: The issue allows remote attackers to read arbitrary files via URLs containing tilde (~) references to home directories. This is demonstrated by accessing the ~root directory.

Recommendations: For Hewlett-Packard (HP) OpenView Configuration Management (CM) Infrastructure versions 4.0 through 4.2i, restrict access to URLs containing tilde () references to prevent arbitrary file reading. For Hewlett-Packard (HP) Client Configuration Manager (CCM) version 2.0, avoid using URLs with tilde () references to home directories until the issue is resolved.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2007-5413

Produtos afetados

Hp Client Configuration Manager

Hp Openview Configuration Management (Cm) Infrastructure

Referências · 9

• http://osvdb.org/39528 · Nota
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01205079 · Aviso do Fabricante
• http://securityfocus.com/archive/1/483106/100/100/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37400 · Nota
• http://vupen.com/english/advisories/2007/3620 · Aviso do Fabricante
• http://securitytracker.com/id?1018858 · Nota
• http://secunia.com/advisories/27341 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-5413 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-07-060.html · Nota