Vulnerabilities > CVE-2016-4361 - Unspecified vulnerability in HP Loadrunner and Performance Center

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
hp
nessus
NVD
Published: 2016-06-08
Updated: 2024-11-21

Summary

HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 allow remote attackers to cause a denial of service via unspecified vectors.

Vulnerable Configurations

Part Description Count
Application
Hp
10

Nessus

  • NASL familyWindows
    NASL idHP_LOADRUNNER_HPSBGN03523.NASL
    descriptionThe version of HP LoadRunner installed on the remote Windows host is 11.52, 12.00, 12.01, 12.02, or 12.50, without the HPSBGN03609 hotfix. It is, therefore, affected by multiple vulnerabilities : - An overflow condition exists in mchan.dll due to a failure to validate the size of a user-supplied string prior to copying it to a stack-based buffer. An unauthenticated, remote attacker can exploit this to cause a stack-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2016-4359) - A flaw exists in the CSV import feature when handling file paths. An unauthenticated, remote attacker can exploit this to delete arbitrary files on the remote system. (CVE-2016-4360) - A flaw exists in the magentservice.exe service that is triggered when handling malformed xdr_string fields in a series of service connection requests. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to crash the service, resulting in a denial of service condition. (CVE-2016-4361)
    last seen2020-06-01
    modified2020-06-02
    plugin id91571
    published2016-06-10
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91571
    titleHP LoadRunner 11.52 / 12.00 / 12.01 / 12.02 / 12.50 Multiple Vulnerabilities
  • NASL familyWindows
    NASL idHP_PERFORMANCE_CENTER_12_53.NASL
    descriptionThe version of HP Performance Center installed on the remote Windows host is 11.52.x or 12.x prior to 12.53. It is, therefore, affected by multiple vulnerabilities : - An overflow condition exists in mchan.dll due to a failure to validate the size of a user-supplied string prior to copying it to a stack-based buffer. An unauthenticated, remote attacker can exploit this to cause a stack-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2016-4359) - A flaw exists in the CSV import feature when handling file paths. An unauthenticated, remote attacker can exploit this to delete arbitrary files on the remote system. (CVE-2016-4360) - A flaw exists in the magentservice.exe service that is triggered when handling malformed xdr_string fields in a series of service connection requests. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to crash the service, resulting in a denial of service condition. (CVE-2016-4361) - A flaw exists in the mchan.dll library due to improper parsing of malformed packets. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to crash the service, resulting in a denial of service condition. (CVE-2016-4384)
    last seen2020-06-01
    modified2020-06-02
    plugin id93811
    published2016-09-30
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/93811
    titleHP Performance Center 11.52.x / 12.x < 12.53 Multiple Vulnerabilities

References