Hewlett Packard Enterprise has released patches for two critical vulnerabilities, one identified in StoreServ Management Console and the other affecting BlueData EPIC Software Platform and Ezmeral Container Platform.
The most severe of these issues was identified in HPE StoreServ Management Console (SSMC) 3.7.0.0 and could be exploited to remotely bypass authentication protections.
Tracked as CVE-2020-7197, the vulnerability features a CVSS score of 10.
SSMC is an off node web-based console that provides support for the management of multiple arrays. The SSMC web application is typically installed on a Linux or Windows server and is isolated from data on the managed arrays.
An error during the processing of authentication requests could allow an attacker to bypass the authentication process and gain access to the application.
The remote authentication bypass was reported by Elwood Buck from MindPoint Group. According to HPE, only HPE 3PAR StoreServ Management and Core Software Media prior to 3.7.0.0 are impacted.
Affected users are advised to upgrade to HPE 3PAR StoreServ Management Console 3.7.1.1 or later to ensure they are not exposed to attacks. In fact, HPE urges customers to install the available updates as soon as possible.
Tracked as CVE-2020-7196 and featuring a CVSS score of 9.9, the second vulnerability was identified in BlueData EPIC Software Platform version 4.0 and earlier, and Ezmeral Container Platform 5.0.
The issue, HPE explains, is that both applications “use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval.”
Specifically, both platforms would show the kdc_admin_password in the source file of the URL /bdswebui/assignusers/, thus exposing this sensitive information to anyone who has access to the file.
The security flaw was reported by Hamoon Raphael Mehran of Early Warning Security.
A BlueData EPIC Software Platform version 4.0 patch has been released and is available upon request. However, HPE advises all BlueData EPIC Software Platform 4.0 or HPE Ezmeral Container Platform 5.0 customers to migrate to Ezmeral Container Platform 5.1 or later.
Last week, HPE also released patches for several high-severity vulnerabilities in Aruba CX Switches, Aruba AirWave Glass, and several other Aruba products.
Related: Critical Vulnerability Allows Hackers to Disrupt SonicWall Firewalls
Related: Cisco Patches Critical Vulnerability in Jabber for Windows
Related: Slack Pays Bounty for Critical Vulnerability in Desktop App
More from Ionut Arghire
- Air Canada Says Employee Information Accessed in Cyberattack
- BIND Updates Patch Two High-Severity DoS Vulnerabilities
- Faster Patching Pace Validates CISA’s KEV Catalog Initiative
- TransUnion Denies Breach After Hacker Publishes Allegedly Stolen Data
- Legit Security Raises $40 Million in Series B Financing
- Atlassian Security Updates Patch High-Severity Vulnerabilities
- Critical Infrastructure Organizations Warned of Snatch Ransomware Attacks
- Tor-Based Drug Marketplace Piilopuoti Shut Down by Law Enforcement
Latest News
- Researchers Discover Attempt to Infect Leading Egyptian Opposition Politician With Predator Spyware
- In Other News: New Analysis of Snowden Files, Yubico Goes Public, Election Hacking
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- Air Canada Says Employee Information Accessed in Cyberattack
- BIND Updates Patch Two High-Severity DoS Vulnerabilities
- Faster Patching Pace Validates CISA’s KEV Catalog Initiative
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
