Hewlett Packard Enterprise has released patches for two critical vulnerabilities, one identified in StoreServ Management Console and the other affecting BlueData EPIC Software Platform and Ezmeral Container Platform.
The most severe of these issues was identified in HPE StoreServ Management Console (SSMC) 3.7.0.0 and could be exploited to remotely bypass authentication protections.
Tracked as CVE-2020-7197, the vulnerability features a CVSS score of 10.
SSMC is an off node web-based console that provides support for the management of multiple arrays. The SSMC web application is typically installed on a Linux or Windows server and is isolated from data on the managed arrays.
An error during the processing of authentication requests could allow an attacker to bypass the authentication process and gain access to the application.
The remote authentication bypass was reported by Elwood Buck from MindPoint Group. According to HPE, only HPE 3PAR StoreServ Management and Core Software Media prior to 3.7.0.0 are impacted.
Affected users are advised to upgrade to HPE 3PAR StoreServ Management Console 3.7.1.1 or later to ensure they are not exposed to attacks. In fact, HPE urges customers to install the available updates as soon as possible.
Tracked as CVE-2020-7196 and featuring a CVSS score of 9.9, the second vulnerability was identified in BlueData EPIC Software Platform version 4.0 and earlier, and Ezmeral Container Platform 5.0.
The issue, HPE explains, is that both applications “use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval.”
Specifically, both platforms would show the kdc_admin_password in the source file of the URL /bdswebui/assignusers/, thus exposing this sensitive information to anyone who has access to the file.
The security flaw was reported by Hamoon Raphael Mehran of Early Warning Security.
A BlueData EPIC Software Platform version 4.0 patch has been released and is available upon request. However, HPE advises all BlueData EPIC Software Platform 4.0 or HPE Ezmeral Container Platform 5.0 customers to migrate to Ezmeral Container Platform 5.1 or later.
Last week, HPE also released patches for several high-severity vulnerabilities in Aruba CX Switches, Aruba AirWave Glass, and several other Aruba products.
Related: Critical Vulnerability Allows Hackers to Disrupt SonicWall Firewalls
Related: Cisco Patches Critical Vulnerability in Jabber for Windows
Related: Slack Pays Bounty for Critical Vulnerability in Desktop App
More from Ionut Arghire
- Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats
- ‘Asylum Ambuscade’ Group Hit Thousands in Cybercrime, Espionage Campaigns
- Google Cloud Now Offering $1 Million Cryptomining Protection
- Pharmaceutical Giant Eisai Takes Systems Offline Following Ransomware Attack
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- US, Israel Provide Guidance on Securing Remote Access Software
Latest News
- In Other News: AI Regulation, Layoffs, US Aerospace Attacks, Post-Quantum Encryption
- Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats
- Google Introduces SAIF, a Framework for Secure AI Development and Use
- ‘Asylum Ambuscade’ Group Hit Thousands in Cybercrime, Espionage Campaigns
- Evidence Suggests Ransomware Group Knew About MOVEit Zero-Day Since 2021
- SaaS Ransomware Attack Hit Sharepoint Online Without Using a Compromised Endpoint
- Google Cloud Now Offering $1 Million Cryptomining Protection
- Democrats and Republicans Are Skeptical of US Spying Practices, an AP-NORC Poll Finds
