(HP Issues Fix for OpenView) Java Runtime Environment Internal Classes Lets Remote Users Access and Execute Files on the Target User's System
|
|
SecurityTracker Alert ID: 1015077 |
|
SecurityTracker URL: http://securitytracker.com/id/1015077
|
|
CVE Reference:
CVE-2005-1974
(Links to External Site)
|
Date: Oct 19 2005
|
Impact:
Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): OpenView Operations 7.x and 8.x; OpenView VantagePoint 6.x
|
Description:
A vulnerability was reported in Java Runtime Environment. A remote user may be able to gain privileges on the target system. HP OpenView is affected.
A remote user can create a specially crafted Java application that, when loaded by the target user, will gain elevated privileges. The application may be able to read and write files or execute applications on the target user's system.
The flaw is related to the accessibility of certain internal classes.
No further details were provided.
The vendor credits Adam Gowdiak with reporting this vulnerability.
|
Impact:
A remote user may be able to read and write files or execute applications on the target user's system with the privileges of the target user.
|
Solution:
HP OpenView Operations and OpenView VantagePoint are affected by this JRE vulnerability.
HP has issued patches, available at:
http://itrc.hp.com
PHSS_33627 OpenView Operations version 8.0 for HP-UX
ITOSOL_00451 OpenView Operations version 8.x for Solaris
PHSS_32406 OpenView Operations version 7.x for HP-UX
ITOSOL_00388 OpenView Operations version 7.x for Solaris
PHSS_33866 OpenView VantagePoint version 6.x for HP-UX
ITOSOL_00468 OpenView VantagePoint version 6.x for Solaris
|
Vendor URL: www2.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBMA01234 (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
UNIX (HP/UX), UNIX (Solaris - SunOS)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Wed, 19 Oct 2005 02:35:04 -0400
Subject: HP OpenView vulnerability
|
http://www2.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBMA01234
> HPSBMA01234 REVISION: 0
> SSRT051052 rev.0 - HP OpenView Operations and OpenView VantagePoint Java Runtime
> Environment (JRE) Remote Privileged Access
|
|
