Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:MISC:HP-PROCURVE-RESET |
|---|---|
Severity |
Minor |
Recommended |
No |
Category |
HTTP |
Keywords |
Hewlett Packard Procurve Remote Reset |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: Hewlett Packard Procurve Remote Reset
This signature detects attempts to exploit a known vulnerability against the HP Procurve 4000M switch. Configuration changes for the switch are made through an HTTP-based interface; however, the script that resets the switch after a configuration change does not properly authenticate the IP address that calls the script. Attackers can call the script repeatedly to perform a denial of service.
Extended Description
When multiple Procurve switches are used interconnected, it is common for an administrator to enable a feature allowing each switch to be viewed through a single interface, accessible via the web. It has been reported that HP Procurve Switches are vulnerable to a denial of service attack, when used in a "stack" configuration. It is possible for an attacker to reset member switches by issuing a device reset command to a vulnerable device. Vulnerable devices do not require authentication before accepting this command. It should be noted that the web interface is not enabled by default.
Affected Products
- Hp procurve_switch_1600m
- Hp procurve_switch_2400m
- Hp procurve_switch_2400m
- Hp procurve_switch_2424m
- Hp procurve_switch_4000m
- Hp procurve_switch_8000m
References
- BugTraq: 5784
- CVE: CVE-2002-1147