SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Generic)  >   HP Systems Insight Manager Vendors:   HP (Compaq)
HP Insight Manager and Other Management Agents May Let Remote Users Gain Access to the System
SecurityTracker Alert ID:  1007983
SecurityTracker URL:  http://securitytracker.com/id/1007983
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Oct 22 2003
Impact:   Root access via local system, Root access via network, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Insight Management for Clients versions 3.5 to 5.0; Remote Diagnostics Enabling Agent (all versions); Insight Manager LC versions 1.00 to 1.60
Description:   A vulnerability was reported in HP's web-enabled Management Agent products, including Insight Manager LC, the Remote Diagnostics Enabling Agent, and the Insight Management for Clients. A remtoe user may be able to gain access to the system.

It is reported that the non-SSL HP management web agent component of these products contains a flaw that may allow a remote user to access the system or a local user to gain elevated privileges on the system.

No further details were provided.

Impact:   A remote user may be able to gain access to the system. A local user may be able to obtain elevated privileges on the system.
Solution:   No solution was available at the time of this entry. HP strongly recommends that customers disable the affected versions. Instructions for determining which version you are running and how to disable it, if necessary, are provided in the Source Message.
Vendor URL:  www.hp.com/ (Links to External Site)
Cause:   Authentication error
Underlying OS:   Windows (Me), Windows (NT), Windows (95), Windows (98), Windows (2000), Windows (XP)

Message History:   None.


 Source Message Contents

Date:  Wed, 22 Oct 2003 14:17:55 -0600
Subject:  Security Bulletin SSRT3632 Potential vulnerability in nonSSL HP management web agent


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SECURITY BULLETIN
 
REVISION: 0
 
SSRT3632 Potential vulnerability in nonSSL HP management web agent


NOTICE: There are no restrictions for distribution of this
        Bulletin provided that it remains complete and intact.

RELEASE DATE:  21 October 2003

SEVERITY:  2

SOURCE:  HEWLETT-PACKARD COMPANY
Software Security Response Team

REFERENCE:  SSRT3499, SSRT3516, SSRT3521, SSRT3530

PROBLEM SUMMARY
A potential security vulnerability has been identified in the
non-SSL web agent that is delivered as part of the HP web-enabled
Management Software, that may result in a unauthorized local
or remote user gaining unauthorized privileged access, or
creating a Denial of Service (DoS).

VERSIONS IMPACTED

The following web-enabled Management Agent products
for desktops, notebooks and workstations running
Microsoft Windows 9x, NT, 2000 and XP:

   Insight Management for Clients versions 3.5 to 5.0

   Remote Diagnostics Enabling Agent  any version

   Insight Manager LC versions 1.00 to 1.60



RESOLUTION
HP strongly recommends that customers disable the
identified versions of web-enabled agents for:

   Insight Management for Clients versions 3.5 to 5.0

   Remote Diagnostics Enabling Agent  any version

   Insight Manager LC versions 1.00 to 1.60

 

HP recommends the following steps be taken to disable
web-enabled agents:

   1)   Determine which systems are running HP web-enabled agents
        or utilities


   2)   Disable the web agent on those systems.




1) Determine which systems are running HP web-enabled agents or
utilities.

There are three methods suggested.

Method 1

Environments running Insight Manager 7 can get a list of systems
running the web-enabled agents by defining a Query to return a
list of systems with web agents.

Login to your Insight Manager 7 system and create a new Query.
Select the "Devices with Web Agent" criteria.
  o Select all of the available products on the Criteria
    Configuration screen.
  o Save the Query and execute it. The list of devices will be all
   those with web agents. You may wish to use this query with the
   Reports feature of Insight Manager 7 (available in SP1 and
   greater) to get printouts of the devices and the software
   loaded. (Insight Manager XE users may follow a similar
   procedure up to but not including the reports.)

NOTE: Prior to running through this procedure, you may want to
perform a new discovery and data collection.  If you first make
sure that the discovery range covers all of the subnets visible
to the Insight Manager 7 system, you will get a potentially
more comprehensive report.

Method 2

Systems running HP Insight Manager Windows 32 console, can get a
List of systems running the web agents by starting HP Insight
Manager and selecting the "Web Device List" button on the
toolbar. This will display a list of systems being managed
by HP Insight Manager and additionally will have underlined
as hyperlinks the systems on which the web agents
are present and enabled. To print out a list of only the web
devices, select the "Web Devices" hyperlink in the left
column and only web devices will be shown. Print this page
from your browser.

NOTE: The lists generated by Methods 1 and 2, while helpful, may
Not be exhaustive lists of the systems with web-enabled agents
and utilities. The lists will include only those systems that
are being managed either explicitly or because they have
been discovered.

Method 3

Point a web browser to the system by keying in
http://[IP_ADDRESS]:2301 or http://[machine_name]:2301

This will bring up the device home page for any servers running
web-enabled management software. This procedure identifies the
presence of the software on 1 system and assumes that you already
know the device name or IP address of every device and use this
procedure to visit them.

2) In order to minimize the risk of your systems due to a
Malicious attack, HP recommends uninstalling or disabling
the web agent software.

To stop the relevant client services, use the NET STOP
command on the following services: CpqWebDmi, DfwWebAgent,
and LCRMS.  To disable the services change the appropriate
Registry service "start" value to 4 as shown below:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqWebDmi]
"Start"=dword:00000004

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DfwWebAgent]
"Start"=dword:00000004

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LCRMS]
"Start"=dword:00000004


Insight Management Agent version 5.01 Rev A (SP24815.EXE / TXT)
ftp://ftp.compaq.com/pub/softpaq/sp24501-25000/SP24815.txt
ftp://ftp.compaq.com/pub/softpaq/sp24501-25000/SP24815.exe
default install process was changed to not install the
web portion of the agent and to also disable the Remote
Diagnostics Enabling Agent (RDEA). RDEA also includes a
web agent. Selecting 'custom install' will still allow the web
agent to be selected and installed.


You may sign up for automatic notification of drivers and alerts
at
http://h30046.www3.hp.com/subhub.php
(select 'driver & support alerts/notifications' then
Servers/HP Server Management Software/HP Management Applications)
but it is recommended that you check back here for new
information periodically and not wait for notifications.

HP strongly recommends that web-enabled agents and
utilities be deployed only on private networks and are
not used on the open Internet or on systems outside
the bounds of a firewall. The implementation of sound
security practices, which includes disabling external
access to HP management ports should help to protect
customers from external malicious attacks. HP also
recommends that strong password standards are used
and that passwords are changed regularly.


SUPPORT: For further information, contact HP Services.

SUBSCRIBE: To subscribe to automatically receive future
Security Advisories from the Software Security Response
Team via electronic mail:
http://www.support.compaq.com/patches/mail-list.shtml
 
REPORT: To report a potential security vulnerability with
any HP supported product, send email to: security-alert@hp.com

As always, HP urges you to periodically review your system
management and security procedures. HP will continue to
review and enhance the security features of its products
and work with our customers to maintain and improve the
security and integrity of their systems.

"HP is broadly distributing this Security Bulletin in order to
bring to the attention of users of the affected HP products
the important security information contained in this Bulletin.
HP recommends that all users determine the applicability of
this information to their individual situations and take
appropriate action. HP does not warrant that this information
is necessarily accurate or complete for all user situations and,
consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information
provided in this Bulletin."


(c)Copyright 2001, 2003 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or
Editorial errors or omissions contained herein. The information
in this document is subject to change without notice.
Hewlett-Packard Company and the names of Hewlett-Packard
products referenced herein are trademarks of Hewlett-Packard
Company in the United States and other countries. Other
product and company names mentioned herein may be
trademarks of their respective owners.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQA/AwUBP5bjOeAfOvwtKn1ZEQIi5QCffXrKVuTdDhIldW3wrjFa7P4hUucAoLT/
hbKk28oUrAHFvhX8f0FeguTR
=ZhCi
-----END PGP SIGNATURE-----

---
You are currently subscribed to security as: **********
To unsubscribe send a blank email to *********************@list.support.compaq.com

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC