CVE-2002-1134
CVSS5.0
发布时间 :2002-10-04 00:00:00
修订时间 :2016-10-17 22:23:59
NMCOS    

[原文]Unknown vulnerability in Compaq WEBES Service Tools 2.0 through WEBES 4.0 (Service Pack 5) allows local users to read privileged files.


[CNNVD]HP WEBES Service Tools Compaq Analyze未授权文件访问漏洞(CNNVD-200210-054)

        
        HP WEBES服务工具Compaq Analyze是Compaq公司所有工具,可以安装在客户站点上进行硬件检测分析等工作。
        Compaq Analyze WEB服务存在漏洞,远程攻击者可以利用这个漏洞未授权访问任意文件。
        Compaq Analyze的WEB接口存在漏洞,非特权用户可以通过WEB接口未授权访问系统文件,目前我们没有获得相关漏洞信息。
        <*链接:http://wwss1pro.compaq.com/support/reference_library/viewdocument.asp?source=SRB0049W.xml&dt=11
        *>

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:hp:webes_service_tools:4.0:sp2
cpe:/a:hp:webes_service_tools:4.0:sp1
cpe:/a:hp:webes_service_tools:4.0:sp4
cpe:/a:hp:webes_service_tools:4.0:sp3
cpe:/a:hp:webes_service_tools:4.0:sp5
cpe:/a:hp:webes_service_tools:2.0
cpe:/a:hp:webes_service_tools:3.1
cpe:/a:hp:webes_service_tools:4.0

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1134
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-1134
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200210-054
(官方数据源) CNNVD

- 其它链接及资源

http://marc.info/?l=bugtraq&m=103280973718587&w=2
(UNKNOWN)  BUGTRAQ  20020923 [security bulletin] SSRT2362 WEBES Service Tools (HP Tru64 UNIX, HP
http://online.securityfocus.com/advisories/4497
(UNKNOWN)  COMPAQ  SSRT2362
http://www.iss.net/security_center/static/10167.php
(UNKNOWN)  XF  webes-unauth-file-access(10167)
http://www.securityfocus.com/bid/5773
(VENDOR_ADVISORY)  BID  5773

- 漏洞信息

HP WEBES Service Tools Compaq Analyze未授权文件访问漏洞
中危 未知
2002-10-04 00:00:00 2005-10-20 00:00:00
远程  
        
        HP WEBES服务工具Compaq Analyze是Compaq公司所有工具,可以安装在客户站点上进行硬件检测分析等工作。
        Compaq Analyze WEB服务存在漏洞,远程攻击者可以利用这个漏洞未授权访问任意文件。
        Compaq Analyze的WEB接口存在漏洞,非特权用户可以通过WEB接口未授权访问系统文件,目前我们没有获得相关漏洞信息。
        <*链接:http://wwss1pro.compaq.com/support/reference_library/viewdocument.asp?source=SRB0049W.xml&dt=11
        *>

- 公告与补丁

        临时解决方法:
        如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:
        * 建议Compaq Analyze web服务:
        1、检查安装:
         使用desta status命令检查WEBES产品是否安装,Director是否运行。
        
        2、关闭CA WEB用户接口:
         这个信息来自CA用户指南。
        
         下面的过程描述怎样关闭Compaq Analyze web服务。
        
         在命令提示行通过输入desta stop命令关闭Director。
        
         如果WEBES安装在Tru64 UNIX或者OpenVMS cluster上,在所有Cluster节点上关闭Director。在Tru64 UNIX上,可从一节点使用/usr/sbin/webes_install_update工具完成。
        
         在OpenVMS上,可以使用SYSMAN执行如下命令完成:
        
         $ mcr sysman
         SYSMAN> set env /cluster
         SYSMAN> do desta stop
         SYSMAN> exit
        3、防止当Director重启动的时候CA WEB接口重新启动:
         在config目录中编辑ConfigDefaultsCA*.txt文件:
        
         Tru64 UNIX -编辑如下文件:
        
         /usr/opt/compaq/svctools/config/ConfigDefaultsCADUnix.txt
         OpenVMS -编辑如下文件:
        
         svctools_home:[config]ConfigDefaultsCAOpenVMS.txt
         Windows -编辑如下文件:
        
         c:\Program Files\Compaq\Svctools\Config\ConfigDefaultsCAWindows.txt
         在下面一行中输入注释符:
        
         com.compaq.svctools.ca.services.web.CAWebService.
         文件内容必须类似如下:
        
         # ConfigDefaultsCAOpenVMS.txt
         #
         # Compaq Analyze Default Components, ** OpenVMS Version **
         #
         # Default components of Compaq Analyze, to enroll the first time the
         # DESTA Director process is executed, as fully qualified Java class
         # names.
         # After DESTA runs the first time, the file Configuration.dat willbe
         # created, and it will be read on startup instead of ConfigDefaults*.txt.
         #
         # Duplicates are OK, so let's add the CommonDirector even though it's
         # also in ConfigDefaultsDESTA.txt, since we can't run the other
         # services without it.
         #
         com.compaq.svctools.desta.core.CommonDirector
         com.compaq.svctools.ca.services.analysis.EvtAnalyzer
         com.compaq.svctools.ca.services.decomposers.EvtDecomposer
         com.compaq.svctools.ca.services.eventreaders.SwccReader
         com.compaq.svctools.ca.services.web.CAWebService
         # The next line is specific to OpenVMS
         com.compaq.svctools.ca.services.eventreaders.VMSReader
         #
         # Uncomment the next line if operation of the Unanalyzed Event
         # Logging service is desired.
         #com.compaq.svctools.ca.services.analysis.UnanalyzedEventLogger
         com.compaq.svctools.desta.services.notification.ACHSNotification
        4、从如下目录中删除configuration.dat文件(假定你使用默认安装):
         Tru64 UNIX - /usr/opt/compaq/svctools/desta/config
         OpenVMS - svctools_home:[desta.config]
         Windows - C:\Program Files\Compaq\Svctools\desta\config
        
        5、按照如下描述重新启动Director:
         HP Tru64 UNIX -
        
         在shell提示符中输入/usr/sbin/desta。需要使用ROOT用户执行操作。如果WEBES安装在Tru64 UNIX cluster上,需要重新启动所有节点上的Director。这可以在每个接点使用/usr/sbin/webes_install_update工具完成。
        
         HP OpenVMS -
        
         在OpenVMS命令行中输入desta start命令。用户必须有正确的权限启动Director。如果WEBES安装在OpenVMS cluster上,重新启动所有节点上的Director。
        
         在OpenVMS上使用SYSMAN执行如下命令:
        
         $ mcr sysman
         SYSMAN> set env /cluster
         SYSMAN> do desta stop
         SYSMAN> exit
        
         在Windows中:
        
         选择Programs | Compaq Service Tools | Web-Based Enterprise Service | Start Director启动Director。
        
         或者
        
         在命令提示窗口中输入net start DESTA_Service命令启动DESTA_Service Windows服务来启动Director。你也可以从控制面板中的服务工具中启动DESTA_Service。
        厂商补丁:
        Compaq
        ------
        Compaq已经为此发布了一个安全公告(SSRT2362)以及相应补丁:
        SSRT2362:WEBES Service Tools (HP Tru64 UNIX, HP OpenVMS, Windows) Potential File Access Vulnerability
        补丁将在如下地址中推出,目前还没有提供:
        
        http://www.compaq.com/support/svctools/webes/

- 漏洞信息

11317
Compaq WEBES Service Tools Arbitrary Local File Access
Local Access Required
Loss of Confidentiality Workaround, Patch / RCS
Vendor Verified

- 漏洞描述

- 时间线

2002-09-21 Unknow
Unknow Unknow

- 解决方案

Compaq has released a patch to address this vulnerability. Additionally, it is possible to temporarily work around the flaw by implementing the following workaround: disable the service.

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

HP WEBES Service Tools Compaq Analyze Unauthorized File Access Vulnerability
Unknown 5773
Yes No
2002-09-23 12:00:00 2009-07-11 05:06:00
This issue was announced in a HP Security Bulletin.

- 受影响的程序版本

HP WEBES Service Tools 4.0 SP5
HP WEBES Service Tools 4.0 SP4
HP WEBES Service Tools 4.0 SP3
HP WEBES Service Tools 4.0 SP2
HP WEBES Service Tools 4.0 SP1
HP WEBES Service Tools 4.0
HP WEBES Service Tools 3.1
HP WEBES Service Tools 2.0

- 漏洞讨论

HP has reported that WEBES Service Tools Compaq Analyze is prone to an issue which may allow unauthorized file access. It may be possible for remote attackers to exploit this issue though the user web interface.

Further details have not been disclosed.

- 漏洞利用

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com &lt;mailto:vuldb@securityfocus.com&gt;.

- 解决方案

The vendor has announced that a hotfix will be made available. The release of the hotfix will be announced at the following location:

http://www.compaq.com/support/svctools/webes/

- 相关参考

     

     

    关于SCAP中文社区

    SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

    版权声明

    CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站