Hewlett-Packard LeftHand Virtual SAN Appliance Password Hash Disclosure Remote Code Execution Vulnerability

February 11th, 2013
ZDI-13-017 ZDI-CAN-1468

CVE ID

CVE-2012-3282

CVSS Score

10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected Vendors

Hewlett-Packard

Affected Products

LeftHand Virtual SAN

Vulnerability Details


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP LeftHand Virtual SAN Appliance. Authentication is not required to exploit this vulnerability.

The flaw exists within the hydra component which listens by default on TCP port 13841. The hydra daemon is responsible for management remote operations such as user creation, snapshots, etc. A client communicating directly with this service can supply a request to the server that yields a response with user credentials including hashed passwords to be disclosed. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the process.

Additional Details

Hewlett-Packard has issued an update to correct this vulnerability. More details can be found at:
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03661318

Disclosure Timeline

  • 2011-12-22 - Vulnerability reported to vendor
  • 2013-02-11 - Coordinated public release of advisory

Credit

e6af8de8b1d4b2b6d5ba2610cbf9cd38

Back to Advisories