PT-2013-3688 · Hewlett Packard · Lefthand Os

Published 2013-07-10 · Updated 2019-10-09 · CVE-2013-2352

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP StoreVirtual Storage devices running LeftHand OS (aka SAN iQ) versions 10.5 and earlier

Description The issue is related to the lack of a mechanism for disabling the HP Support challenge-response root-login feature. This makes it easier for remote attackers to obtain administrative access by leveraging knowledge of an unused one-time password.

Recommendations For versions 10.5 and earlier, consider disabling the root-login feature or restricting access to the HP Support challenge-response mechanism until a fix is available.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-2352

Affected Products

Lefthand Os

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-2352 · Security Note
• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03825537 · Vendor Advisory
• http://theregister.co.uk/2013/07/09/hp_storage_more_possible_backdoors · Note