|The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.|
HP SiteScope: six vulnerabilities
Synthesis of the vulnerability
An unauthenticated attacker can use several vulnerabilities of HP SiteScope, in order to execute privileged code.
Impacted products: SiteScope.
Creation date: 29/08/2012.
Identifiers: BID-55269, BID-55273, c03489683, CERTA-2012-AVI-517, CVE-2012-3259, CVE-2012-3260, CVE-2012-3261, CVE-2012-3262, CVE-2012-3263, CVE-2012-3264, HPSBMU02815, SSRT100715, SSRT100717, SSRT100718, SSRT100719, SSRT100720, VIGILANCE-VUL-11903, ZDI-12-173, ZDI-12-174, ZDI-12-175, ZDI-12-176, ZDI-12-177, ZDI-12-178, ZDI-CAN-1461, ZDI-CAN-1463, ZDI-CAN-1464, ZDI-CAN-1465, ZDI-CAN-1472.
Description of the vulnerability
Six vulnerabilities were announced in HP SiteScope.
An unauthenticated attacker can call the SOAP getSiteScopeConfiguration() function, in order to obtain the administrator password. [severity:3/4; ZDI-12-173]
An unauthenticated attacker can use the UploadFilesHandler url, in order to upload a script on the server. [severity:3/4; BID-55273, ZDI-12-174]
An unauthenticated attacker can call the SOAP create() function, in order to create a new user. [severity:3/4; ZDI-12-175]
An unauthenticated attacker can call the SOAP getFileInternal() function, in order to read the configuration, which contains passwords. [severity:3/4; ZDI-12-176]
An unauthenticated attacker can call the SOAP loadFileContent() function, in order to read configuration files, which contain passwords. [severity:3/4; ZDI-12-177]
An unauthenticated attacker can call the SOAP update() function, in order to change the administrator's password. [severity:3/4; ZDI-12-178]
Complete Vigil@nce bulletin.... (free trial)
Computer vulnerabilities tracking service
Vigil@nce provides networks vulnerabilities alerts. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications. The Vigil@nce vulnerability database contains several thousand vulnerabilities. The technology watch team tracks security threats targeting the computer system.