Multiple vulnerabilities in HP OneView



Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2010-5298
CVE-2014-0198
CVE-2014-0224
CWE-ID CWE-362
CWE-476
CWE-310
Exploitation vector Network
Public exploit Public exploit code for vulnerability #3 is available.
Vulnerable software
 HPE OneView
Other software / Other software solutions

Vendor HPE

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Race condition

EUVDB-ID: #VU11535

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2010-5298

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack or modify encrypted connection.

The vulnerability exists due to a race condition in the ssl3_read_bytes() function in OpenSSL. A remote attacker can inject data across sessions or cause a denial of service

Successful exploitation of the vulnerability requires that SSL_MODE_RELEASE_BUFFERS is enabled.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HPE OneView: 1.0 - 1.05

CPE2.3 External links

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-c04368264


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) NULL pointer dereference

EUVDB-ID: #VU11534

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-0198

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the in the do_ssl3_write() function in OpenSSL. A remote attacker can send a specially crafted request to vulnerable application and trigger denial of service attack.

Successful exploitation of the vulnerability requires that SSL_MODE_RELEASE_BUFFERS is enabled.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HPE OneView: 1.0 - 1.05

CPE2.3 External links

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-c04368264


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Man-in-the-Middle attack

EUVDB-ID: #VU2950

Risk: Medium

CVSSv4.0: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2014-0224

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to decrypt encrypted connections.

The vulnerability exists due to an error in OpenSSL. A remote attacker with ability to intercept network traffic can decrypt SSL connection and gain access to sensitive data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HPE OneView: 1.0 - 1.05

CPE2.3 External links

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-c04368264


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.



###SIDEBAR###