HP Performance Manager Apache Tomcat Policy Bypass

2010-11-0500:00:00

SAINT Corporation

download.saintcorporation.com

162

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.171 Low

EPSS

Percentile

95.5%

JSON

Added: 11/05/2010
CVE: CVE-2009-3548
BID: 36954
OSVDB: 60176

Background

HP Performance Manager Software is a web-based analysis and visualization tool that analyzes performance trends of applications, systems, and services. HP Performance Manager incorporates Apache Tomcat 5 to help serve custom web applications.

Problem

An unauthorized file upload vulnerability exists in HP Performance Manager. HP Performance Manager generates credentials for a default user/password combination in Apache Tomcat. A remote attacker can leverage this vulnerability by sending a crafted HTTP request using the default credentials. Once authenticated, the attacker can upload a malicious web application to a vulnerable system.

Resolution

Apply the fix referenced in HP Security Bulletin HPSBMA02535.

References

<http://secunia.com/advisories/39847/>

Limitations

Exploit works on HP Performance Manager 8.1 on Microsoft Windows Server 2003 and Windows Server 2008.

It may take longer than usual to establish the connection after successful exploitation because it takes time for the affected server to deploy the malicious WAR file.