|
|
| |
Credit:
The information has been provided by Nicolas Gr?ire / Agarri.
The original article can be found at: http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=958
|
| |
Vulnerable Systems:
* HP P4000 Virtual SAN/iQ versions prior to 9.5
Remote exploitation of an arbitrary command execution vulnerability in HP.'s StorageWorks P4000 Virtual SAN Appliance (VSA) could allow an attacker to execute arbitrary code with the privileges of the affected service.
The management service implements a protocol command to allow a remote client to ping a remote device from the VSA. Input passed as part of this ping request is not correctly sanitized. This condition may result in an arbitrary command execution. This vulnerability does not require authentication as default account credentials are hard-coded into the management service.
Vendor Status:
HP has released patches and workarounds to address this vulnerability.
Patch Availability:
http://www.hp.com/go/p4000downloads
CVE Information:
CVE-2011-4157
Disclosure Timeline:
10/20/2010 Initial Vendor Notification
11/09/2010 Initial Vendor Reply
11/11/2011 Coordinated Public Disclosure
|
|
|
