PT-2018-17914 · Hewlett Packard+1 · Hpe Windows Firmware Installer+3

Published 2018-10-25 · Updated 2020-08-24 · CVE-2018-7112

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HPE Windows firmware installer versions prior to the updated versions released in system ROM and HPE Integrated Lights-Out (iLO) releases documented in HPE Security Bulletins: HPESBHF03805, HPESBHF03835, HPESBHF03831

Description The issue allows local disclosure of privileged information. It was resolved in previously provided firmware updates. The updated HPE Windows firmware installer was released in system ROM and HPE Integrated Lights-Out (iLO) releases, which also addressed the original Spectre/Meltdown set of vulnerabilities.

Recommendations For HPE Windows firmware installer versions prior to the updated versions, update to the system ROM or iLO versions described in the HPE Security Bulletins: HPESBHF03805, HPESBHF03835, HPESBHF03831 to resolve the issue. Windows-based systems that have already been updated to the system ROM or iLO versions described in these security bulletins require no further action.

Fix

Related Identifiers

CVE-2018-7112

Affected Products

Hp Integrated Lights-Out

Hpe Windows Firmware Installer

Hpe Ilo

Windows

References · 7

• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03869en_us · Vendor Advisory
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03835en_us · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7112 · Vendor Advisory
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03805en_us · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7112 · Security Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03831en_us · Vendor Advisory
• http://securitytracker.com/id/1041984 · Note