Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2003.0738 -- HEWLETT-PACKARD COMPANY SECURITY BULLETIN
SSRT3632 Potential vulnerability in nonSSL HP management web agent
23 October 2003
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Insight Management for Clients versions 3.5 - 5.0
Remote Diagnostics Enabling Agent
Insight Manager LC versions 1.00 - 1.60
Publisher: Hewlett-Packard
Operating System: Windows XP
Windows 2000
Windows 9x
Impact: Inappropriate Access
Denial of Service
Access Required: Remote
- --------------------------BEGIN INCLUDED TEXT--------------------
SECURITY BULLETIN
REVISION: 0
SSRT3632 Potential vulnerability in nonSSL HP management web agent
NOTICE: There are no restrictions for distribution of this
Bulletin provided that it remains complete and intact.
RELEASE DATE: 21 October 2003
SEVERITY: 2
SOURCE: HEWLETT-PACKARD COMPANY
Software Security Response Team
REFERENCE: SSRT3499, SSRT3516, SSRT3521, SSRT3530
PROBLEM SUMMARY
A potential security vulnerability has been identified in the
non-SSL web agent that is delivered as part of the HP web-enabled
Management Software, that may result in a unauthorized local
or remote user gaining unauthorized privileged access, or
creating a Denial of Service (DoS).
VERSIONS IMPACTED
The following web-enabled Management Agent products
for desktops, notebooks and workstations running
Microsoft Windows 9x, NT, 2000 and XP:
Insight Management for Clients versions 3.5 to 5.0
Remote Diagnostics Enabling Agent any version
Insight Manager LC versions 1.00 to 1.60
RESOLUTION
HP strongly recommends that customers disable the
identified versions of web-enabled agents for:
Insight Management for Clients versions 3.5 to 5.0
Remote Diagnostics Enabling Agent any version
Insight Manager LC versions 1.00 to 1.60
HP recommends the following steps be taken to disable
web-enabled agents:
1) Determine which systems are running HP web-enabled agents
or utilities
2) Disable the web agent on those systems.
1) Determine which systems are running HP web-enabled agents or
utilities.
There are three methods suggested.
Method 1
Environments running Insight Manager 7 can get a list of systems
running the web-enabled agents by defining a Query to return a
list of systems with web agents.
Login to your Insight Manager 7 system and create a new Query.
Select the "Devices with Web Agent" criteria.
o Select all of the available products on the Criteria
Configuration screen.
o Save the Query and execute it. The list of devices will be all
those with web agents. You may wish to use this query with the
Reports feature of Insight Manager 7 (available in SP1 and
greater) to get printouts of the devices and the software
loaded. (Insight Manager XE users may follow a similar
procedure up to but not including the reports.)
NOTE: Prior to running through this procedure, you may want to
perform a new discovery and data collection. If you first make
sure that the discovery range covers all of the subnets visible
to the Insight Manager 7 system, you will get a potentially
more comprehensive report.
Method 2
Systems running HP Insight Manager Windows 32 console, can get a
List of systems running the web agents by starting HP Insight
Manager and selecting the "Web Device List" button on the
toolbar. This will display a list of systems being managed
by HP Insight Manager and additionally will have underlined
as hyperlinks the systems on which the web agents
are present and enabled. To print out a list of only the web
devices, select the "Web Devices" hyperlink in the left
column and only web devices will be shown. Print this page
from your browser.
NOTE: The lists generated by Methods 1 and 2, while helpful, may
Not be exhaustive lists of the systems with web-enabled agents
and utilities. The lists will include only those systems that
are being managed either explicitly or because they have
been discovered.
Method 3
Point a web browser to the system by keying in
http://[IP_ADDRESS]:2301 or http://[machine_name]:2301
This will bring up the device home page for any servers running
web-enabled management software. This procedure identifies the
presence of the software on 1 system and assumes that you already
know the device name or IP address of every device and use this
procedure to visit them.
2) In order to minimize the risk of your systems due to a
Malicious attack, HP recommends uninstalling or disabling
the web agent software.
To stop the relevant client services, use the NET STOP
command on the following services: CpqWebDmi, DfwWebAgent,
and LCRMS. To disable the services change the appropriate
Registry service "start" value to 4 as shown below:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqWebDmi]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DfwWebAgent]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LCRMS]
"Start"=dword:00000004
Insight Management Agent version 5.01 Rev A (SP24815.EXE / TXT)
ftp://ftp.compaq.com/pub/softpaq/sp24501-25000/SP24815.txt
ftp://ftp.compaq.com/pub/softpaq/sp24501-25000/SP24815.exe
default install process was changed to not install the
web portion of the agent and to also disable the Remote
Diagnostics Enabling Agent (RDEA). RDEA also includes a
web agent. Selecting 'custom install' will still allow the web
agent to be selected and installed.
You may sign up for automatic notification of drivers and alerts
at
http://h30046.www3.hp.com/subhub.php
(select 'driver & support alerts/notifications' then
Servers/HP Server Management Software/HP Management Applications)
but it is recommended that you check back here for new
information periodically and not wait for notifications.
HP strongly recommends that web-enabled agents and
utilities be deployed only on private networks and are
not used on the open Internet or on systems outside
the bounds of a firewall. The implementation of sound
security practices, which includes disabling external
access to HP management ports should help to protect
customers from external malicious attacks. HP also
recommends that strong password standards are used
and that passwords are changed regularly.
SUPPORT: For further information, contact HP Services.
SUBSCRIBE: To subscribe to automatically receive future
Security Advisories from the Software Security Response
Team via electronic mail:
http://www.support.compaq.com/patches/mail-list.shtml
REPORT: To report a potential security vulnerability with
any HP supported product, send email to: security-alert@hp.com
As always, HP urges you to periodically review your system
management and security procedures. HP will continue to
review and enhance the security features of its products
and work with our customers to maintain and improve the
security and integrity of their systems.
"HP is broadly distributing this Security Bulletin in order to
bring to the attention of users of the affected HP products
the important security information contained in this Bulletin.
HP recommends that all users determine the applicability of
this information to their individual situations and take
appropriate action. HP does not warrant that this information
is necessarily accurate or complete for all user situations and,
consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information
provided in this Bulletin."
(c)Copyright 2001, 2003 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or
Editorial errors or omissions contained herein. The information
in this document is subject to change without notice.
Hewlett-Packard Company and the names of Hewlett-Packard
products referenced herein are trademarks of Hewlett-Packard
Company in the United States and other countries. Other
product and company names mentioned herein may be
trademarks of their respective owners.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business
hours which are GMT+10:00 (AEST). On call after hours
for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBP5cYJSh9+71yA2DNAQEmGQP/UYL/FKeJ208mFYwWkYAesxxbkZQaBuhB
KxhSjccNM9DzR6ZjAWU6GkLc+yvj+rGo85ulf+Go1yndNwlLBwODuqxKoCi2j0BY
AsMZsWD4MOyksSiZo3pM3lIcg4fnUwwuwMJwQsYhtvyLr/A6Sv5cmJfaPv6KVLLm
h+vqoBYXuck=
=UDVe
-----END PGP SIGNATURE-----