PT-2011-2250 · Hewlett Packard · Hp Openview Performance Insight Server

Stephen Fewer · Publicado 2011-01-31 · Atualizado 2018-10-10 · CVE-2011-0276

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP OpenView Performance Insight Server versions 5.2 through 5.41

Description The issue concerns a hidden account in the com.trinagy.security.XMLUserManager Java class, allowing remote attackers to execute arbitrary code via the doPost method in the com.trinagy.servlet.HelpManagerServlet class.

Recommendations For HP OpenView Performance Insight Server versions 5.2 through 5.41, consider disabling the com.trinagy.servlet.HelpManagerServlet class until a patch is available to prevent exploitation of the hidden account. Restrict access to the com.trinagy.security.XMLUserManager Java class to minimize the risk of arbitrary code execution.

Exploit

Correção

Identificadores relacionados

CVE-2011-0276

ZDI-11-034

Produtos afetados

Hp Openview Performance Insight Server

Referências · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hp_openview_insight_backdoor.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16984 · Exploit
• 🔥 http://exploit-db.com/exploits/16984 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-11-034 · Nota de Segurança
• http://securityreason.com/securityalert/8136 · Nota
• http://securityfocus.com/archive/1/516093/100/0/threaded · Nota
• http://vupen.com/english/advisories/2011/0258 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-0276 · Nota de Segurança
• http://securityfocus.com/bid/46079 · Nota
• http://secunia.com/advisories/43145 · Aviso do Fabricante
• http://osvdb.org/70754 · Nota
• http://securitytracker.com/id?1025014 · Nota
• http://zerodayinitiative.com/advisories/ZDI-11-034 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65038 · Nota
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02695453 · Aviso do Fabricante