PT-2019-4455 · Hewlett Packard · Hp Thinpro Linux

Publicado 2019-11-20 · Atualizado 2020-08-24 · CVE-2019-16287

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP ThinPro Linux versions 6.2 through 7.1

Description The issue is related to insecure privilege management, allowing an attacker to create a file on the local file system that puts the device in Administrative Mode. This enables the attacker to execute commands with elevated privileges. The vulnerability can be exploited to gain privileged access and execute arbitrary code with increased privileges.

Recommendations For HP ThinPro Linux versions 6.2 through 7.1, consider restricting access to the local file system to prevent the creation of files that could put the device in Administrative Mode, until a patch is available. As a temporary workaround, monitor the device for any unexpected files or changes in the file system that could indicate an attempt to exploit this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

BDU:2020-00242

CVE-2019-16287

Produtos afetados

Hp Thinpro Linux

Referências · 6

• https://bdu.fstec.ru/vul/2020-00242 · Nota de Segurança
• http://seclists.org/fulldisclosure/2020/Mar/38 · Nota
• https://osv.dev/vulnerability/CVE-2019-16287 · Aviso do Fabricante
• https://support.hp.com/us-en/document/c06509350 · Aviso do Fabricante
• http://packetstormsecurity.com/files/156899/HP-ThinPro-6.x-7.x-Privilege-Escalation.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16287 · Nota de Segurança