HP System Management Homepage iprange Parameter Stack Buffer Overflow

2013-09-09T00:00:00
ID SAINT:3AC28D8186DA66757645F2914E3951BB
Type saint
Reporter SAINT Corporation
Modified 2013-09-09T00:00:00

Description

Added: 09/09/2013
CVE: CVE-2013-2362
BID: 61337
OSVDB: 95489

Background

HP System Management Homepage (SMH) is a web-based interface that consolidates the management of ProLiant and Integrity servers.

Problem

A stack buffer overflow vulnerability in HP SMH allows command execution when an attacker requests **/proxy/DataValidation** with an overly long **iprange** parameter. A remote unauthenticated attacker could exploit this vulnerability to run arbitrary code on the vulnerable target as the SYSTEM user.

Resolution

Upgrade to HP System Management Homepage version 7.2.1 or higher.

References

<http://www.zerodayinitiative.com/advisories/ZDI-13-204/>
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c03839862

Limitations

Exploit works on HP System Management Homepage 7.2.0-14 on Windows Server 2003 SP2 English (DEP OptOut).

This exploit requires the IO-Socket-SSL Perl module.

Platforms

Windows