HP SiteScope SOAP Call APIPreferenceImpl Security Bypass

Added: 10/22/2012
CVE: CVE-2012-3261
BID: 55269
OSVDB: 85796

Background

HP SiteScope is an agentless software application used to monitor the availability and performance of distributed IT infrastructures including servers, operating systems, network and Internet services, applications and application components.

Problem

HP SiteScope versions 11.10, 11.11, and 11.12 are vulnerable to remote code execution via a vulnerable SOAP call using **APIPreferenceImpl**.

Resolution

Upgrade to SiteScope v11.13 or newer. In addition, an administrator must disable the vulnerable SOAP API by adding the **_disableOldAPIs=true** property to the **master.config** file.

References

<http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683&gt;

Limitations

This exploit has been tested against HP SiteScope 11.20 on Microsoft Windows Server 2003 SP2 English (DEP OptOut) and Microsoft Windows Server 2008 SP2 (DEP OptOut).

Platforms

Windows