Vulnerabilities > CVE-2017-8948 - Unspecified vulnerability in HP Network Node Manager I
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
A Remote Bypass Security Restriction vulnerability in HPE Network Node Manager i (NNMi) Software versions v10.0x, v10.1x, v10.2x was found.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 5 |
Nessus
NASL family Windows NASL id HP_NNMI_HPESBGN03762.NASL description The version of HPE Network Node Manager i (NNMi) installed on the remote Windows host is 10.0x prior to 10.00 Patch 5, 10.1x prior to 10.10 Patch 4, or 10.2x prior to 10.20 Patch 3. It is, therefore, affected by multiple vulnerabilities that allow an unauthenticated, remote attacker to execute arbitrary code, bypass security restrictions, and perform unauthorized actions. Note that Nessus has not tested for these issues but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 101297 published 2017-07-07 reporter This script is Copyright (C) 2017-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/101297 title HPE Network Node Manager i (NNMi) Multiple Vulnerabilities (HPESBGN03762) NASL family Windows NASL id HP_INTELLIGENT_MANAGEMENT_CENTER_7_3_E0504P04.NASL description The version of HPE Intelligent Management Center (iMC) PLAT installed on the Windows host is prior to 7.3 E0504P04. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-5815) - A command injection vulnerability exists in the dbman service due to improper validation of user-supplied input before it is passed to a system call. An unauthenticated, remote attacker can exploit this, via a specially crafted opcode 10008 request, to inject and execute arbitrary OS commands with SYSTEM privileges. (CVE-2017-5816) - Multiple command injection vulnerabilities exist in the dbman service due to improper validation of user-supplied input before it is passed to a system call. An unauthenticated, remote attacker can exploit these, via a specially crafted opcode 10007 request, to inject and execute arbitrary OS commands with SYSTEM privileges. (CVE-2017-5817, CVE-2017-5819) - A flaw exists in the dbman service when handling opcode 10007 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to delete arbitrary files with SYSTEM privileges. (CVE-2017-5818) - A flaw exists in the dbman service when handling opcode 10004 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2017-5820) - A flaw exists in the dbman service when handling opcode 10006 and 10010 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially request, to execute arbitrary code. (CVE-2017-5821) - A flaw exists in the dbman service when handling opcode 10010 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2017-5822) - A flaw exists in the dbman service when handling opcode 10013 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2017-5823) - A NULL pointer deference flaw exists, specifically in the asn1_item_embed_d2i() function within file crypto/asn1/tasn_dec.c, when handling the ASN.1 CHOICE type, which results in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-7053) - A heap overflow condition exists in the chacha20_poly1305_cipher() function within file crypto/evp/e_chacha20_poly1305.c when handling TLS connections using *-CHACHA20-POLY1305 cipher suites. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-7054) - A carry propagation error exists in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - An unspecified remote code execution vulnerability exists that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-8948) - A stack-based buffer overflow condition exists due to improper validation of input when copying data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8956) Note that Intelligent Management Center (iMC) is an HPE product; however, it is branded as H3C. last seen 2020-06-01 modified 2020-06-02 plugin id 100869 published 2017-06-19 reporter This script is Copyright (C) 2017-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/100869 title H3C / HPE Intelligent Management Center PLAT < 7.3 E0504P04 Multiple Vulnerabilities NASL family Red Hat Local Security Checks NASL id HP_NNMI_HPESBGN03762-RHEL.NASL description The version of HPE Network Node Manager i (NNMi) installed on the remote Linux host is 10.0x prior to 10.00 Patch 5, 10.1x prior to 10.10 Patch 4, or 10.2x prior to 10.20 Patch 3. It is, therefore, affected by multiple vulnerabilities that allow an unauthenticated, remote attacker to execute arbitrary code, bypass security restrictions, and perform unauthorized actions. Note that Nessus has not tested for these issues but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 101296 published 2017-07-07 reporter This script is Copyright (C) 2017-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/101296 title HPE Network Node Manager i (NNMi) Multiple Vulnerabilities (HPESBGN03762) NASL family Misc. NASL id HP_IMC_73_E0504P04.NASL description The version of HPE Intelligent Management Center (iMC) PLAT installed on the remote host is prior to 7.3 E0504P04. It is, therefore, affected by multiple vulnerabilities : - A NULL pointer deference flaw exists, specifically in the asn1_item_embed_d2i() function within file crypto/asn1/tasn_dec.c, when handling the ASN.1 CHOICE type, which results in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-7053) - A heap overflow condition exists in the chacha20_poly1305_cipher() function within file crypto/evp/e_chacha20_poly1305.c when handling TLS connections using *-CHACHA20-POLY1305 cipher suites. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-7054) - A carry propagation error exists in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - An unspecified flaw exists that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-5815) - A command injection vulnerability exists in the dbman service due to improper validation of user-supplied input before it is passed to a system call. An unauthenticated, remote attacker can exploit this, via a specially crafted opcode 10008 request, to inject and execute arbitrary OS commands with SYSTEM privileges. (CVE-2017-5816) - Multiple command injection vulnerabilities exist in the dbman service due to improper validation of user-supplied input before it is passed to a system call. An unauthenticated, remote attacker can exploit these, via a specially crafted opcode 10007 request, to inject and execute arbitrary OS commands with SYSTEM privileges. (CVE-2017-5817, CVE-2017-5819) - A flaw exists in the dbman service when handling opcode 10007 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to delete arbitrary files with SYSTEM privileges. (CVE-2017-5818) - A flaw exists in the dbman service when handling opcode 10004 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2017-5820) - A flaw exists in the dbman service when handling opcode 10006 and 10010 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially request, to execute arbitrary code. (CVE-2017-5821) - A flaw exists in the dbman service when handling opcode 10010 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2017-5822) - A flaw exists in the dbman service when handling opcode 10013 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2017-5823) - An unspecified remote code execution vulnerability exists that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-8948) - A stack-based buffer overflow condition exists due to improper validation of input when copying data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8956) Note that Intelligent Management Center (iMC) is an HPE product; however, it is branded as H3C. last seen 2020-06-01 modified 2020-06-02 plugin id 100868 published 2017-06-19 reporter This script is Copyright (C) 2017-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/100868 title H3C / HPE Intelligent Management Center PLAT < 7.3 E0504P04 Multiple Vulnerabilities