Sign-up

ID

VAR-201108-0084


CVE

CVE-2011-2403


TITLE

HP Network Automation In SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2011-004699

DESCRIPTION

SQL injection vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. HP Network Automation is an automated network configuration management tool. HP Network Automation running on Linux, Solaris and Windows platforms has security vulnerabilities that allow attackers to perform SQL injection attacks, allowing attackers to obtain sensitive information or manipulate databases. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. The vulnerabilities could be exploited remotely resulting in SQL injection and cross site scripting (XSS). References: CVE-2011-2402(XSS), CVE-2011-2403 (SQL injection) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP Network Automation v7.2x, v7.5x, v7.6x, v9.0, v9.10 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2011-2402 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2011-2403 (AV:N/AC:L/Au:S/C:C/I:C/A:C) 9.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided a patch to resolve the vulnerabilities for HP Network Automation v9.10. The patch is available here: http://support.openview.hp.com/selfsolve/patches Upgrade to HP Network Automation v9.10 Apply patch 1 or subsequent (Title: Network Automation 09.10.01, Document ID: KM1207081) HISTORY Version:1 (rev.1) - 28 July 2011 Initial Release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For further information, contact normal HP Services support channel. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2011 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAk4xdeMACgkQ4B86/C0qfVntSwCdF4drR9sS5wJ4+kFmIYfnv4NJ 7QcAn13pc8sXX/aSZf4FHCfx+7aFUpQw =v+ei -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- The Secunia Vulnerability Intelligence Manager (VIM) enables you to handle vulnerability threats in a simple, cost effective way. Read more and request a free trial: http://secunia.com/products/corporate/vim/ ---------------------------------------------------------------------- TITLE: HP Network Automation Cross-Site Scripting and SQL Injection Vulnerabilities SECUNIA ADVISORY ID: SA45454 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/45454/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=45454 RELEASE DATE: 2011-07-30 DISCUSS ADVISORY: http://secunia.com/advisories/45454/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/45454/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=45454 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Two vulnerabilities have been reported in HP Network Automation, which can be exploited by malicious users to conduct SQL injection attacks and by malicious people to conduct cross-site scripting attacks. 1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The vulnerabilities reported in versions 7.2x, 7.5x, 7.6x, 9.0, and 9.10. SOLUTION: Update to version 9.10 and apply patch 1 or later. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: HPSBMU02693 SSRT100583: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02942385 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.79

sources: NVD: CVE-2011-2403 // JVNDB: JVNDB-2011-004699 // CNVD: CNVD-2011-2908 // BID: 48924 // IVD: c0b08234-2354-11e6-abef-000c29c66e3d // PACKETSTORM: 103537 // PACKETSTORM: 103578

IOT TAXONOMY

category:['IoT', 'ICS']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: c0b08234-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-2908

AFFECTED PRODUCTS

vendor:hpmodel:network automationscope:eqversion:7.2

Trust: 2.5

vendor:hpmodel:network automationscope:eqversion:7.5

Trust: 2.5

vendor:hpmodel:network automationscope:eqversion:7.6

Trust: 2.5

vendor:hpmodel:network automationscope:eqversion:9.0

Trust: 2.5

vendor:hpmodel:network automationscope:eqversion:9.10

Trust: 2.5

vendor:hewlett packardmodel:hp network automationscope:eqversion:7.2x

Trust: 0.8

vendor:hewlett packardmodel:hp network automationscope:eqversion:7.5x

Trust: 0.8

vendor:hewlett packardmodel:hp network automationscope:eqversion:7.6x

Trust: 0.8

vendor:hewlett packardmodel:hp network automationscope:eqversion:9.0

Trust: 0.8

vendor:hewlett packardmodel:hp network automationscope:eqversion:and 9.10

Trust: 0.8

vendor:hpmodel:network automationscope:eqversion:0

Trust: 0.3

vendor:network automationmodel: - scope:eqversion:7.2

Trust: 0.2

vendor:network automationmodel: - scope:eqversion:7.5

Trust: 0.2

vendor:network automationmodel: - scope:eqversion:7.6

Trust: 0.2

vendor:network automationmodel: - scope:eqversion:9.0

Trust: 0.2

vendor:network automationmodel: - scope:eqversion:9.10

Trust: 0.2

sources: IVD: c0b08234-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-2908 // BID: 48924 // JVNDB: JVNDB-2011-004699 // CNNVD: CNNVD-201107-452 // NVD: CVE-2011-2403

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-2403
value: MEDIUM

Trust: 1.0

NVD: CVE-2011-2403
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201107-452
value: MEDIUM

Trust: 0.6

IVD: c0b08234-2354-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

nvd@nist.gov: CVE-2011-2403
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

IVD: c0b08234-2354-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: c0b08234-2354-11e6-abef-000c29c66e3d // JVNDB: JVNDB-2011-004699 // CNNVD: CNNVD-201107-452 // NVD: CVE-2011-2403

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.8

sources: JVNDB: JVNDB-2011-004699 // NVD: CVE-2011-2403

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201107-452

TYPE

SQL injection

Trust: 0.8

sources: IVD: c0b08234-2354-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201107-452

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-004699

PATCH
title:HPSBMU02693 SSRT100583url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02942385
Trust: 0.8
title:Patch for HP Network Automation SQL Injection Vulnerability (CNVD-2011-2908)url:https://www.cnvd.org.cn/patchInfo/show/4569
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2011-2908 // 
            
            
            
            JVNDB: JVNDB-2011-004699

EXTERNAL IDS
db:NVDid:CVE-2011-2403
Trust: 3.6
db:BIDid:48924
Trust: 1.9
db:SECUNIAid:45454
Trust: 1.7
db:SECTRACKid:1025862
Trust: 1.0
db:OSVDBid:74134
Trust: 1.0
db:SREASONid:8321
Trust: 1.0
db:CNVDid:CNVD-2011-2908
Trust: 0.8
db:CNNVDid:CNNVD-201107-452
Trust: 0.8
db:JVNDBid:JVNDB-2011-004699
Trust: 0.8
db:NSFOCUSid:17374
Trust: 0.6
db:HPid:HPSBMU02693
Trust: 0.6
db:HPid:SSRT100583
Trust: 0.6
db:IVDid:C0B08234-2354-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:PACKETSTORMid:103537
Trust: 0.1
db:PACKETSTORMid:103578
Trust: 0.1
sources:
            
            
            IVD: c0b08234-2354-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2011-2908 // 
            
            
            
            BID: 48924 // 
            
            
            
            JVNDB: JVNDB-2011-004699 // 
            
            
            
            PACKETSTORM: 103537 // 
            
            
            
            PACKETSTORM: 103578 // 
            
            
            
            CNNVD: CNNVD-201107-452 // 
            
            
            
            NVD: CVE-2011-2403

REFERENCES
url:http://marc.info/?l=bugtraq&m=131188727830971&w=2
Trust: 2.2
url:http://www.securityfocus.com/bid/48924
Trust: 1.6
url:http://secunia.com/advisories/45454
Trust: 1.6
url:http://osvdb.org/74134
Trust: 1.0
url:http://securityreason.com/securityalert/8321
Trust: 1.0
url:http://www.securitytracker.com/id?1025862
Trust: 1.0
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/68886
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2403
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-2403
Trust: 0.8
url:http://seclists.org/bugtraq/2011/jul/219
Trust: 0.6
url:http://www.nsfocus.net/vulndb/17374
Trust: 0.6
url:http://www.hp.com
Trust: 0.3
url:http://support.openview.hp.com/selfsolve/patches
Trust: 0.1
url:http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-2403
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-2402
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=45454
Trust: 0.1
url:http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docdisplay/?docid=emr_na-c02942385
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/45454/#comments
Trust: 0.1
url:http://secunia.com/products/corporate/vim/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/45454/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2011-2908 // 
            
            
            
            BID: 48924 // 
            
            
            
            JVNDB: JVNDB-2011-004699 // 
            
            
            
            PACKETSTORM: 103537 // 
            
            
            
            PACKETSTORM: 103578 // 
            
            
            
            CNNVD: CNNVD-201107-452 // 
            
            
            
            NVD: CVE-2011-2403

CREDITS
HP
Trust: 1.0
sources:
            
            
            BID: 48924 // 
            
            
            
            PACKETSTORM: 103537 // 
            
            
            
            CNNVD: CNNVD-201107-452

SOURCES
db:IVDid:c0b08234-2354-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2011-2908
db:BIDid:48924
db:JVNDBid:JVNDB-2011-004699
db:PACKETSTORMid:103537
db:PACKETSTORMid:103578
db:CNNVDid:CNNVD-201107-452
db:NVDid:CVE-2011-2403

LAST UPDATE DATE
2024-08-14T13:58:48.989000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2011-2908date:2011-07-29T00:00:00
db:BIDid:48924date:2011-07-28T00:00:00
db:JVNDBid:JVNDB-2011-004699date:2012-03-27T00:00:00
db:CNNVDid:CNNVD-201107-452date:2011-08-02T00:00:00
db:NVDid:CVE-2011-2403date:2017-08-29T01:29:24.770

SOURCES RELEASE DATE
db:IVDid:c0b08234-2354-11e6-abef-000c29c66e3ddate:2011-07-29T00:00:00
db:CNVDid:CNVD-2011-2908date:2011-07-29T00:00:00
db:BIDid:48924date:2011-07-28T00:00:00
db:JVNDBid:JVNDB-2011-004699date:2012-03-27T00:00:00
db:PACKETSTORMid:103537date:2011-07-29T02:11:55
db:PACKETSTORMid:103578date:2011-07-29T06:28:44
db:CNNVDid:CNNVD-201107-452date:1900-01-01T00:00:00
db:NVDid:CVE-2011-2403date:2011-08-01T19:55:01.163