|
|
|
|
| |
Credit:
The information has been provided by iDefense Labs Security Advisories.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=728
|
| |
Vulnerable Systems:
* HP's Internet Services Probe Builder version 2.2 for Windows
The Probe Builder Service, PBOVISServer.exe, listens by default on TCP port 32968. This process has a specific opcode that allows a remote unauthenticated user to terminate any process on the system by supplying a process ID number.
Analysis:
Exploitation allows an attacker to kill any process, including critical system processes like services.exe, lsass.exe, csrss.exe. Killing a system process usually results in a blue screen or a mandatory reboot message. To exploit this vulnerability, the attacker must know the process ID to terminate. For a remote attacker, it can brute force process ID and cause the system to crash.
Workaround:
Employing firewalls to limit access to the affected service will mitigate exposure to this vulnerability.
Vendor response:
Hewlett-Packard has addressed this vulnerability in the HPSBMA02353 (SSRT080066) security bulletin. For more information, visit the following URL. http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01511225
CVE Information:
CVE-2008-1667
Disclosure timeline:
04/03/2008 - Initial vendor notification
05/08/2008 - Initial vendor response
07/28/2008 - Coordinated public disclosure
|
|
|
|
|
