PT-2014-3064 · Hewlett Packard · Hp Service Virtualization

Rgod · Publicado 2014-06-11 · Atualizado 2014-07-18 · CVE-2013-6221

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Service Virtualization versions 3.x before 3.50.1

Description A directory traversal issue in the CommunicationServlet of HP Service Virtualization allows remote attackers to create arbitrary files, potentially leading to the execution of arbitrary code when the AutoPass license server is enabled.

Recommendations For HP Service Virtualization versions 3.x before 3.50.1, update to version 3.50.1 or later to resolve the issue. As a temporary workaround, consider disabling the AutoPass license server to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2013-6221

ZDI-14-195

Produtos afetados

Hp Service Virtualization

Referências · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hp_autopass_license_traversal.rb · Exploit
• 🔥 https://exploit-db.com/exploits/33891 · Exploit
• 🔥 http://exploit-db.com/exploits/33891 · Exploit
• http://osvdb.org/107943 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6221 · Nota de Segurança
• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04333125 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-14-195 · Nota de Segurança
• http://packetstormsecurity.com/files/127247/HP-AutoPass-License-Server-File-Upload.html · Nota
• http://securitytracker.com/id/1030385 · Nota
• http://zerodayinitiative.com/advisories/ZDI-14-195 · Nota