Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.1463.4
HPSBMU02931 rev.4 - HP Service Manager, Injection of Arbitrary Code, Remote
Privilege Elevation, Remote Disclosure of Privileged
Information and Cross Site Scripting (XSS)
3 January 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: HP Service Manager
Publisher: Hewlett-Packard
Operating System: AIX
Linux variants
Windows
Solaris
HP-UX
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Increased Privileges -- Remote/Unauthenticated
Access Privileged Data -- Remote/Unauthenticated
Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2013-4833 CVE-2013-4832 CVE-2013-4831
CVE-2013-4830
Original Bulletin:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03960916
Revision History: January 3 2014: Added HP Service Manager v9.20 and v9.21 to impacted versions
December 16 2013: Added HP ServiceCenter v6.2.8
November 1 2013: added HP Service Manager v7.11 to impacted versions
October 16 2013: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
Note: the current version of the following document is available here:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c03960916
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03960916
Version: 4
HPSBMU02931 rev.4 - HP Service Manager and ServiceCenter, Injection of
Arbitrary Code, Remote Privilege Elevation, Remote Disclosure of Privileged
Information and Cross Site Scripting (XSS)
NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.
Release Date: 2013-10-30
Last Updated: 2013-12-19
Potential Security Impact: Injection of arbitrary code, remote disclosure of
privileged Information , improper Privilege management and cross site
scripting (XSS)
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with HP Service
Manager and ServiceCenter. The vulnerabilities could be exploited to allow
injection of arbitrary code, remote disclosure of privileged Information ,
improper privilege management and cross site scripting (XSS).
Note: The Service Manager and ServiceCenter resolutions below include updated
Apache Tomcat, OpenSSL, Oracle JRE that address security issues in those
components.
References:
CVE-2013-4830 (SSRT101316)
CVE-2013-4831
CVE-2013-4832
CVE-2013-4833
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP Service Manager v7.11, v9.20, v9.21, v9.30, v9.31, v9.32
HP ServiceCenter v6.2.8
BACKGROUND
CVSS 2.0 Base Metrics
===========================================================
Reference Base Vector Base Score
CVE-2013-4830 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2013-4831 (AV:N/AC:M/Au:S/C:P/I:P/A:N) 4.9
CVE-2013-4832 (AV:N/AC:M/Au:S/C:P/I:N/A:N) 3.5
CVE-2013-4833 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3
===========================================================
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP has made the following software updates available to resolve the
vulnerabilities.
The updates can be downloaded from HP Software Support Online (SSO).
HP Product/Version
Platform/Component
Location
HP Service Manager v9.32.0016
AIX Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00446
HP Service Manager 9.32.0016
HP Itanium Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00447
HP Service Manager 9.32.0016
Linux Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00448
HP Service Manager 9.32.0016
Solaris Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00449
HP Service Manager 9.32.0016
Windows Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00450
HP Service Manager 9.32.0016
Web Tier
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00451
HP Service Manager 9.32.0016
Windows Client
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00452
HP Service Manager 9.32.0016
KnowledgeManagement
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00454
HP Service Manager 9.32.0005
Mobility
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00455
HP Service Manager 9.32.0016
Applications
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00456
HP Service Manager 9.21.661 p8
AIX Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00498
HP Service Manager v9.21.661 p8
HP Itanium Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00499
HP Service Manager v9.21.661 p8
HP parisc Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00500
HP Service Manager v9.21.661 p8
Linux Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00501
HP Service Manager v9.21.661 p8
Solaris Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00502
HP Service Manager v9.21.661 p8
Windows Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00503
HP Service Manager v9.21.661 p8
Web Tier
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00504
HP Service Manager v9.21.661 p8
Windows Client
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00505
HP Service Manager 7.11.655 p21
AIX Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00482
HP Service Manager 7.11.655 p21
HP Itanium Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00483
HP Service Manager 7.11.655 p21
HP parisc Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00484
HP Service Manager 7.11.655 p21
Linux x86 Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00485
HP Service Manager 7.11.655 p21
Solaris Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00486
HP Service Manager 7.11.655 p21
Windows Server
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00487
HP Service Manager 7.11.655 p21
Web Tier
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00488
HP Service Manager 7.11.655 p21
Windows Client
http://support.openview.hp.com/selfsolve/document/LID/HPSM_00489
HP ServiceCenter 6.2.8.14
AIX Server
http://support.openview.hp.com/selfsolve/document/LID/HPSC_00279
HP ServiceCenter 6.2.8.14
HP Itanium Server
http://support.openview.hp.com/selfsolve/document/LID/HPSC_00280
HP ServiceCenter 6.2.8.14
HP parisc Server
http://support.openview.hp.com/selfsolve/document/LID/HPSC_00281
HP ServiceCenter 6.2.8.14
Linux Server
http://support.openview.hp.com/selfsolve/document/LID/HPSC_00282
HP ServiceCenter 6.2.8.14
Solaris Server
http://support.openview.hp.com/selfsolve/document/LID/HPSC_00283
HP ServiceCenter 6.2.8.14
Windows Server
http://support.openview.hp.com/selfsolve/document/LID/HPSC_00284
HP ServiceCenter 6.2.8.14
Web Tier
http://support.openview.hp.com/selfsolve/document/LID/HPSC_00285
HP ServiceCenter 6.2.8.14
Windows Client
http://support.openview.hp.com/selfsolve/document/LID/HPSC_00286
HISTORY
Version:1 (rev.1) - 14 October 2013 Initial release
Version:2 (rev.2) - 30 October 2013 Added HP Service Manager v7.11 to
impacted versions
Version:3 (rev.3) - 11 December 2013 Added HP ServiceCenter v6.2.8
Version:4 (rev.4) - 19 December 2013 Added HP Service Manager v9.20 and
v9.21 to impacted versions (update either to v9.21.661 p8)
Third Party Security Patches: Third party security patches that are to be
installed on systems running HP software products should be applied in
accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HP Services support channel. For other issues about
the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported
product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin
alerts via Email:
http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin Archive: A list of recently released Security Bulletins is
available here:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in
the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX
System management and security procedures must be reviewed frequently to
maintain system integrity. HP is continually reviewing and enhancing the
security features of software products to provide customers with current
secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the
attention of users of the affected HP products the important security
information contained in this Bulletin. HP recommends that all users determine
the applicability of this information to their individual situations and take
appropriate action. HP does not warrant that this information is necessarily
accurate or complete for all user situations and, consequently, HP will not be
responsible for any damages resulting from user's use or disregard of the
information provided in this Bulletin. To the extent permitted by law, HP
disclaims all warranties, either express or implied, including the warranties
of merchantability and fitness for a particular purpose, title and
non-infringement."
Copyright 2013 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors
or omissions contained herein. The information provided is provided "as is"
without warranty of any kind. To the extent permitted by law, neither HP or
its affiliates, subcontractors or suppliers will be liable for
incidental,special or consequential damages including downtime cost; lost
profits; damages relating to the procurement of substitute products or
services; or damages for loss of data, or software restoration. The
information in this document is subject to change without notice.
Hewlett-Packard Company and the names of Hewlett-Packard products referenced
herein are trademarks of Hewlett-Packard Company in the United States and
other countries. Other product and company names mentioned herein may be
trademarks of their respective owners.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUsYpOhLndAQH1ShLAQLQqxAArZPK1q0gaxKggG9YAIaeJC8ODNK4Y8Kq
7zTiURPGbCL2rMiX7LTS9SfFJ1bcwJeVQ22U/O9Hkpo6FzGM97ykzUJNJ5OQxM4U
5L7JII5kpnQ2HBJe3qDmM2wdl6ypqHb/Zja8AH+58KajKYv8+02+HW9SoBJ1r4BK
cxYqnbO9QUpG+3t0Rf6AtVkIhmF3MbtfCvjzTfigvLLA65ppSWdsKxNjKCnFcy7b
WWF5b6nOaOAs4eXdIuFIXlB//UYH/c1Mrzb9r3BYa0gaWnrQSCYVBbHDeUsTdJiN
9yFACQuGLnqYlzcIIeP0GqCqCcy4zccJfDJKuB2wlbXc9SdHawWj0dPgsMngYjTV
Qezb0Q+J9fDd4e5FX8nWjyQC1OKjiFV+HgeMaO/6fIQqeiCfYxVUisf3Q+aoZ86P
gnZ2nsDfTw21dqJ5o7kv54maSKU1Xn7shHT02XpeCO+G7jVw0skCxsxH3w/OdvIt
H+Wp50xZpbf0VWI87mpWYFXfpifTtlqrfcUx2k39fxyw1nItU42s0zVq2B9HahHI
NNI2nAiAbLz/ylPHkqC43I2u52wXB59CrUUP3z+PMVy1kyT4DFp6AGcSQva3w4h4
R27WPxmYoyCaKBUbe/s29g0hTCH6wTozBBVd3/dZt85/WeSx/XRz40J2nhmOhu/h
ASNRxpnQcdY=
=s87b
-----END PGP SIGNATURE-----