PT-2013-3688 · Hewlett Packard · Lefthand Os

Publicado 2013-07-10 · Atualizado 2019-10-09 · CVE-2013-2352

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP StoreVirtual Storage devices running LeftHand OS (aka SAN iQ) versions 10.5 and earlier

Description The issue is related to the lack of a mechanism for disabling the HP Support challenge-response root-login feature. This makes it easier for remote attackers to obtain administrative access by leveraging knowledge of an unused one-time password.

Recommendations For versions 10.5 and earlier, consider disabling the root-login feature or restricting access to the HP Support challenge-response mechanism until a fix is available.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2013-2352

Produtos afetados

Lefthand Os

Referências · 3

• http://theregister.co.uk/2013/07/09/hp_storage_more_possible_backdoors · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-2352 · Nota de Segurança
• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03825537 · Aviso do Fabricante