PT-2016-3491 · Hewlett Packard · Hpe Helion Eucalyptus

Published 2016-01-05 · Updated 2016-01-05 · CVE-2014-5040

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HP Helion Eucalyptus versions 4.1.x through 4.1.1 HPE Helion Eucalyptus versions 4.2.x through 4.2.0

Description The issue allows remote authenticated users to bypass intended access restrictions. This can be achieved in two ways: by modifying arbitrary access key credentials if the attacker has knowledge of a key ID, or by modifying signing certificates if the attacker has knowledge of a certificate ID.

Recommendations For HP Helion Eucalyptus versions 4.1.x through 4.1.1, update to version 4.1.2 or later. For HPE Helion Eucalyptus versions 4.2.x through 4.2.0, update to version 4.2.1 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-5040

Affected Products

Hpe Helion Eucalyptus

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-5040 · Security Note
• https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04926463 · Vendor Advisory
• https://eucalyptus.com/resources/security/advisories/esa-32 · Vendor Advisory