Immunity Advisory: Compaq Web Management vulnerability

Chris Wysopal <[email protected]>
Newsgroups gmane.comp.security.vulnerabilities.watch.announce
Message-ID <[email protected]> 
Excerpt:

Remote, unauthenticated certificate upload in Compaq Web Management (HP
HTTP) Compaq Web Management includes a number of daemons, which listen on
a number of TCP ports, and also to SNMP requests. On port 2381, an SSL
HTTP server runs. If the system is configured to let anonymous users
browse it, a common configuration, then a bug in the validation system
allows users to upload their own certificates to be trusted by the client
system. This would then allow that machine to be administered remotely via
such mechanisms as Secure Task Execution.

Full Advisory:

http://www.immunitysec.com/downloads/hp_http.sxw.pdf
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.