[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UNIRAS Brief - 582/03 - Hewlett Packard Security Bulletin



 
-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------------------
   UNIRAS (UK Govt CERT) Briefing Notice - 582/03 dated 23.10.03  Time: 11:00
 UNIRAS is part of NISCC(National Infrastructure Security Co-ordination Centre)
- ---------------------------------------------------------------------------------- 
  UNIRAS material is also available from its website at www.uniras.gov.uk and
         Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------
Title
=====
Potential vulnerability in nonSSL HP management web agent.

Detail
====== 
A potential security vulnerability has been identified in the
non-SSL web agent that may result in a unauthorized local
or remote user gaining unauthorized privileged access, or
creating a Denial of Service (DoS).

- ---------------------------------------------------------------------------------- 
PROBLEM SUMMARY
A potential security vulnerability has been identified in the
non-SSL web agent that is delivered as part of the HP web-enabled
Management Software, that may result in a unauthorized local
or remote user gaining unauthorized privileged access, or
creating a Denial of Service (DoS).

VERSIONS IMPACTED

The following web-enabled Management Agent products
for desktops, notebooks and workstations running
Microsoft Windows 9x, NT, 2000 and XP:

   Insight Management for Clients versions 3.5 to 5.0

   Remote Diagnostics Enabling Agent  any version

   Insight Manager LC versions 1.00 to 1.60

RESOLUTION
HP strongly recommends that customers disable the
identified versions of web-enabled agents for:

   Insight Management for Clients versions 3.5 to 5.0

   Remote Diagnostics Enabling Agent  any version

   Insight Manager LC versions 1.00 to 1.60 

HP recommends the following steps be taken to disable
web-enabled agents:

   1)   Determine which systems are running HP web-enabled agents
        or utilities

   2)   Disable the web agent on those systems.

1) Determine which systems are running HP web-enabled agents or
utilities.

There are three methods suggested.

Method 1

Environments running Insight Manager 7 can get a list of systems
running the web-enabled agents by defining a Query to return a
list of systems with web agents.

Login to your Insight Manager 7 system and create a new Query.
Select the "Devices with Web Agent" criteria.
  o Select all of the available products on the Criteria
    Configuration screen.
  o Save the Query and execute it. The list of devices will be all
   those with web agents. You may wish to use this query with the
   Reports feature of Insight Manager 7 (available in SP1 and
   greater) to get printouts of the devices and the software
   loaded. (Insight Manager XE users may follow a similar
   procedure up to but not including the reports.)

NOTE: Prior to running through this procedure, you may want to
perform a new discovery and data collection.  If you first make
sure that the discovery range covers all of the subnets visible
to the Insight Manager 7 system, you will get a potentially
more comprehensive report.

Method 2

Systems running HP Insight Manager Windows 32 console, can get a
List of systems running the web agents by starting HP Insight
Manager and selecting the "Web Device List" button on the
toolbar. This will display a list of systems being managed
by HP Insight Manager and additionally will have underlined
as hyperlinks the systems on which the web agents
are present and enabled. To print out a list of only the web
devices, select the "Web Devices" hyperlink in the left
column and only web devices will be shown. Print this page
from your browser.

NOTE: The lists generated by Methods 1 and 2, while helpful, may
Not be exhaustive lists of the systems with web-enabled agents
and utilities. The lists will include only those systems that
are being managed either explicitly or because they have
been discovered.

Method 3

Point a web browser to the system by keying in
http://[IP_ADDRESS]:2301 or http://[machine_name]:2301

This will bring up the device home page for any servers running
web-enabled management software. This procedure identifies the
presence of the software on 1 system and assumes that you already
know the device name or IP address of every device and use this
procedure to visit them.

2) In order to minimize the risk of your systems due to a
Malicious attack, HP recommends uninstalling or disabling
the web agent software.

To stop the relevant client services, use the NET STOP
command on the following services: CpqWebDmi, DfwWebAgent,
and LCRMS.  To disable the services change the appropriate
Registry service "start" value to 4 as shown below:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqWebDmi]
"Start"=dword:00000004

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DfwWebAgent]
"Start"=dword:00000004

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LCRMS]
"Start"=dword:00000004

Insight Management Agent version 5.01 Rev A (SP24815.EXE / TXT)
ftp://ftp.compaq.com/pub/softpaq/sp24501-25000/SP24815.txt
ftp://ftp.compaq.com/pub/softpaq/sp24501-25000/SP24815.exe
default install process was changed to not install the
web portion of the agent and to also disable the Remote
Diagnostics Enabling Agent (RDEA). RDEA also includes a
web agent. Selecting 'custom install' will still allow the web
agent to be selected and installed.

You may sign up for automatic notification of drivers and alerts
at
http://h30046.www3.hp.com/subhub.php
(select 'driver & support alerts/notifications' then
Servers/HP Server Management Software/HP Management Applications)
but it is recommended that you check back here for new
information periodically and not wait for notifications.

HP strongly recommends that web-enabled agents and
utilities be deployed only on private networks and are
not used on the open Internet or on systems outside
the bounds of a firewall. The implementation of sound
security practices, which includes disabling external
access to HP management ports should help to protect
customers from external malicious attacks. HP also
recommends that strong password standards are used
and that passwords are changed regularly.

SUPPORT: For further information, contact HP Services.

SUBSCRIBE: To subscribe to automatically receive future
Security Advisories from the Software Security Response
Team via electronic mail:
http://www.support.compaq.com/patches/mail-list.shtml
 
REPORT: To report a potential security vulnerability with
any HP supported product, send email to: security-alert@xxxxxx

As always, HP urges you to periodically review your system
management and security procedures. HP will continue to
review and enhance the security features of its products
and work with our customers to maintain and improve the
security and integrity of their systems.

"HP is broadly distributing this Security Bulletin in order to
bring to the attention of users of the affected HP products
the important security information contained in this Bulletin.
HP recommends that all users determine the applicability of
this information to their individual situations and take
appropriate action. HP does not warrant that this information
is necessarily accurate or complete for all user situations and,
consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information
provided in this Bulletin."

- ----------------------------------------------------------------------------------
For additional information or assistance, please contact the HELP Desk by 
telephone or Not Protectively Marked information may be sent via EMail to:
uniras@xxxxxxxxxxxx

Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 20 7821 1330 Ext 4511
Fax: +44 (0) 20 7821 1686

Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 20 7821 1330 and follow the prompts

- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Hewlett Packard for the
information contained in this Briefing. 
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the canonical site 
to ensure that you receive the most current information concerning that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQCVAwUBP5enTopao72zK539AQGC0AQAi+a9VzE2nxBW4GW7pPvBzoKDiOG8r6su
q45ELsR/0JVHWVzOaPvOKQgyJX23p/O94SYj0Eu9bNy/tal91RhwXtNMInS8CN7k
cmLKdTLdBKl/xROIFbLktPTM+GvvOR3xqqTsb4ohkLqsk7XdATTbbCvOrjspoCaq
UA8J8dQfN9M=
=EEtn
-----END PGP SIGNATURE-----