KLA10529 Multiple vulnerabilities in HP iLO

An unspecified vulnerabilities were found in KP iLO. By exploiting these vulnerabilities malicious users can gain privileges, bypass security restrictions, cause denial of service or execute arbitrary code. These vulnerabilities can be exploited remotely via an unknwon versions.

Original advisories

HP advisory

HP advisory

Related products

HP-Integrated-Lights-Out

CVE list

CVE-2015-2106 high

CVE-2014-7876 critical

Solution

Install patches released by vendor

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• HP Integrated Lights-Out firmware 2 versions earlier than 2.27HP Integrated Lights-Out firmware 3 versions earlier than 1.82HP Integrated Lights-Out firmware 4 versions earlier than 2.10