PT-2007-6450 · Hewlett Packard · Hp Openview Configuration Management (Cm) Infrastructure+1

Published 2007-10-29 · Updated 2018-10-15 · CVE-2007-5413

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Hewlett-Packard (HP) OpenView Configuration Management (CM) Infrastructure versions 4.0 through 4.2i Hewlett-Packard (HP) Client Configuration Manager (CCM) version 2.0

Description: The issue allows remote attackers to read arbitrary files via URLs containing tilde (~) references to home directories. This is demonstrated by accessing the ~root directory.

Recommendations: For Hewlett-Packard (HP) OpenView Configuration Management (CM) Infrastructure versions 4.0 through 4.2i, restrict access to URLs containing tilde () references to prevent arbitrary file reading. For Hewlett-Packard (HP) Client Configuration Manager (CCM) version 2.0, avoid using URLs with tilde () references to home directories until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-5413

Affected Products

Hp Client Configuration Manager

Hp Openview Configuration Management (Cm) Infrastructure

References · 9

• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01205079 · Vendor Advisory
• http://vupen.com/english/advisories/2007/3620 · Vendor Advisory
• http://secunia.com/advisories/27341 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5413 · Security Note
• http://osvdb.org/39528 · Note
• http://securityfocus.com/archive/1/483106/100/100/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37400 · Note
• http://securitytracker.com/id?1018858 · Note
• http://zerodayinitiative.com/advisories/ZDI-07-060.html · Note