Vulnerabilities > CVE-2017-12545 - NULL Pointer Dereference vulnerability in HP System Management Homepage

047910
CVSS 7.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
COMPLETE
network
low complexity
hp
linux
microsoft
CWE-476
nessus

Summary

A remote denial of service vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

Vulnerable Configurations

Part Description Count
Application
Hp
83
OS
Linux
1
OS
Microsoft
1

Common Weakness Enumeration (CWE)

Nessus

NASL familyWeb Servers
NASL idHPSMH_7_6_1.NASL
descriptionAccording to its banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is prior to 7.6.1. It is, therefore, affected by multiple vulnerabilities including multiple local and remote code execution vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application
last seen2020-06-01
modified2020-06-02
plugin id103530
published2017-09-28
reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/103530
titleHP System Management Homepage < 7.6.1 Multiple Vulnerabilities (HPSBMU03753)
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(103530);
  script_version("1.8");
  script_cvs_date("Date: 2019/11/13");

  script_cve_id(
    "CVE-2016-8743",
    "CVE-2017-12544",
    "CVE-2017-12545",
    "CVE-2017-12546",
    "CVE-2017-12547",
    "CVE-2017-12548",
    "CVE-2017-12549",
    "CVE-2017-12550",
    "CVE-2017-12551",
    "CVE-2017-12552",
    "CVE-2017-12553"
  );
  script_xref(name:"HP", value:"HPSBMU03753");
  script_xref(name:"IAVB", value:"2017-B-0132");

  script_name(english:"HP System Management Homepage < 7.6.1 Multiple Vulnerabilities (HPSBMU03753)");
  script_summary(english:"Performs a banner check.");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its banner, the version of HP System Management Homepage
(SMH) hosted on the remote web server is prior to 7.6.1. It is,
therefore, affected by multiple vulnerabilities including
multiple local and remote code execution vulnerabilities.

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  # https://support.hpe.com/hpsc/doc/public/display?docId=hpesbmu03753en_us
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?05d894b4");
  script_set_attribute(attribute:"solution", value:
"Upgrade to HP System Management Homepage (SMH) version 7.6.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-12553");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/09/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/09/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/09/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:hp:system_management_homepage");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("compaq_wbem_detect.nasl", "os_fingerprint.nasl");
  script_require_keys("www/hp_smh");
  script_require_ports("Services/www", 2301, 2381);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("install_func.inc");

# Only Linux and Windows are affected
os = get_kb_item_or_exit("Host/OS");
if ("Windows" >!< os && "Linux" >!< os) audit(AUDIT_OS_NOT, "Windows or Linux", os);

port = get_http_port(default:2381, embedded:TRUE);
app = "hp_smh";
get_install_count(app_name:app, exit_if_zero:TRUE);

install = get_single_install(
  app_name : app,
  port     : port,
  exit_if_unknown_ver : TRUE
);

dir = install['dir'];
version = install['version'];
prod = get_kb_item_or_exit("www/"+port+"/hp_smh/variant");
source_line = get_kb_item("www/"+port+"/hp_smh/source");

if (version == UNKNOWN_VER) audit(AUDIT_UNKNOWN_WEB_APP_VER, prod, build_url(port:port, qs:dir+"/") );

# nb: 'version' can have non-numeric characters in it so we'll create
#     an alternate form and make sure that's safe for use in 'ver_compare()'.
version_alt = ereg_replace(pattern:"[_-]", replace:".", string:version);
if (!ereg(pattern:"^[0-9][0-9.]+$", string:version_alt))
  audit(AUDIT_VER_FORMAT, version);

if (ver_compare(ver:version_alt, fix:"7.6.1", strict:FALSE) == -1)
{
  report = '\n  Product           : ' + prod;
  if (!isnull(source_line))
    report += '\n  Version source    : ' + source_line;
  report +=
    '\n  Installed version : ' + version +
    '\n  Fixed version     : 7.6.1' +
    '\n';

  security_report_v4(severity:SECURITY_WARNING, port:port, extra:report, xss:TRUE);
  exit(0);
}
else audit(AUDIT_LISTEN_NOT_VULN, prod, port, version);