Aung Khant (aungkhant<@>yehg.net)
YGN Ethical Hacker Group, Myanmar
HP System Management Homepage
Consolidated system management information helps IT Administrators predict,
diagnose, and rapidly respond to potential and actual system failures for a single server.
Vendor: HP Inc (http://www.hp.com)
URL Redirection Abuse
Other versions(3.x) might be affected as well.
Date published: 04-25-2010
Attacker can lure victim to redirect to his choice of malicious site via the
trusted vulnerable SMH url. From there, serious attacks such as browser exploits can be performed
to compromise victim's OS.
- Remove red3201.html under hpsmh\data\htdocs\ directory OR
- sanitize RedirectUrl variable OR
- Wait for Vendor's fix in next 4-6 months
OWASP-TOP10-2010: A8 - Unvalidated Redirects and Forwards
WASC-38 URL Redirector Abuse
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
03-10-2010: found vulnerability
04-12-2010: contacted vendor @ http://welcome.hp.com/country/us/en/sftware_security.html
04-12-2010: vendor responded
04-14-2010: vendor confirmed and would release fix within 4 to 6 months.
Vendor Response (HP Software Security Response Team):
>We are able to duplicate the vulnerability.
>I expect we can resolve the vulnerability in the next SMH patch.
>Because regularly scheduled patches are easier for customers to incorporate
>we prefer to resolve vulnerabilities in those patches rather than in special hotfixes.
>I don't have a patch schedule, but normally SMH is patched every four to six months.
# yehg [04-25-2010]