PT-2014-3064 · Hewlett Packard · Hp Service Virtualization

Rgod · Published 2014-06-11 · Updated 2014-07-18 · CVE-2013-6221

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Service Virtualization versions 3.x before 3.50.1

Description A directory traversal issue in the CommunicationServlet of HP Service Virtualization allows remote attackers to create arbitrary files, potentially leading to the execution of arbitrary code when the AutoPass license server is enabled.

Recommendations For HP Service Virtualization versions 3.x before 3.50.1, update to version 3.50.1 or later to resolve the issue. As a temporary workaround, consider disabling the AutoPass license server to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2013-6221

ZDI-14-195

Affected Products

Hp Service Virtualization

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hp_autopass_license_traversal.rb · Exploit
• 🔥 https://exploit-db.com/exploits/33891 · Exploit
• 🔥 http://exploit-db.com/exploits/33891 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6221 · Security Note
• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04333125 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-14-195 · Security Note
• http://osvdb.org/107943 · Note
• http://packetstormsecurity.com/files/127247/HP-AutoPass-License-Server-File-Upload.html · Note
• http://securitytracker.com/id/1030385 · Note
• http://zerodayinitiative.com/advisories/ZDI-14-195 · Note