PT-2018-17889 · Hewlett Packard · Hpe Intelligent Management Center (Imc) Plat

Published 2018-07-26 · Updated 2018-10-18 · CVE-2018-7074

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center (iMC) PLAT versions prior to 7.3 E0605P04

Description A remote code execution issue was identified. The estimated number of potentially affected devices worldwide is not available. Details about real-world incidents where this issue was exploited are not provided. Technical details about exploitation include a stack-based buffer overflow in the tftpserver component, specifically in the getFileData function.

Recommendations For versions prior to 7.3 E0605P04, update to iMC PLAT 7.3 E0605P04 or a subsequent version to resolve the issue. As a temporary workaround, consider restricting access to the tftpserver component until a patch is available.

Fix

Related Identifiers

CVE-2018-7074

ZDI-18-778

Affected Products

Hpe Intelligent Management Center (Imc) Plat

References · 5

• https://zerodayinitiative.com/advisories/ZDI-18-778 · Security Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03864en_us · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7074 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7074 · Security Note
• http://securitytracker.com/id/1041354 · Note