Vulnerability-Lookup

CNVD-2017-01370

Vulnerability from cnvd - Published: 2017-02-15

Title

多款HP产品存在未明远程代码执行漏洞

Description

HP StoreVirtual 4000 Storage和StoreVirtual VSA都是美国惠普（HP）公司的适用于虚拟化环境的存储设备。StoreVirtual 4000 Storage是一套基于LeftHand操作系统的横向扩展存储平台。StoreVirtual VSA是一套软件定义的虚拟存储设备。多款HP产品存在未明远程代码执行漏洞。攻击者利用该漏洞在受影响的应用程序环境中执行任意代码。失败的攻击会造成拒绝服务。

Severity

中

Patch Name

多款HP产品存在未明远程代码执行漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05382958

Reference

http://www.securityfocus.com/bid/95970

Impacted products

Name
['HP StoreVirtual VSA Software Licenses 0', 'HP StoreVirtual VSA Software running LeftHand OS <=12.5', 'HP HPE StoreVirtual 4000 Storage <=12.5']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "95970"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-8529",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8529"
    }
  },
  "description": "HP StoreVirtual 4000 Storage\u548cStoreVirtual VSA\u90fd\u662f\u7f8e\u56fd\u60e0\u666e\uff08HP\uff09\u516c\u53f8\u7684\u9002\u7528\u4e8e\u865a\u62df\u5316\u73af\u5883\u7684\u5b58\u50a8\u8bbe\u5907\u3002StoreVirtual 4000 Storage\u662f\u4e00\u5957\u57fa\u4e8eLeftHand\u64cd\u4f5c\u7cfb\u7edf\u7684\u6a2a\u5411\u6269\u5c55\u5b58\u50a8\u5e73\u53f0\u3002StoreVirtual VSA\u662f\u4e00\u5957\u8f6f\u4ef6\u5b9a\u4e49\u7684\u865a\u62df\u5b58\u50a8\u8bbe\u5907\u3002\r\n\r\n\u591a\u6b3eHP\u4ea7\u54c1\u5b58\u5728\u672a\u660e\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u73af\u5883\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u5931\u8d25\u7684\u653b\u51fb\u4f1a\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "discovererName": "HP",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05382958",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-01370",
  "openTime": "2017-02-15",
  "patchDescription": "HP StoreVirtual 4000 Storage\u548cStoreVirtual VSA\u90fd\u662f\u7f8e\u56fd\u60e0\u666e\uff08HP\uff09\u516c\u53f8\u7684\u9002\u7528\u4e8e\u865a\u62df\u5316\u73af\u5883\u7684\u5b58\u50a8\u8bbe\u5907\u3002StoreVirtual 4000 Storage\u662f\u4e00\u5957\u57fa\u4e8eLeftHand\u64cd\u4f5c\u7cfb\u7edf\u7684\u6a2a\u5411\u6269\u5c55\u5b58\u50a8\u5e73\u53f0\u3002StoreVirtual VSA\u662f\u4e00\u5957\u8f6f\u4ef6\u5b9a\u4e49\u7684\u865a\u62df\u5b58\u50a8\u8bbe\u5907\u3002\r\n\r\n\u591a\u6b3eHP\u4ea7\u54c1\u5b58\u5728\u672a\u660e\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u73af\u5883\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u5931\u8d25\u7684\u653b\u51fb\u4f1a\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eHP\u4ea7\u54c1\u5b58\u5728\u672a\u660e\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "HP StoreVirtual VSA Software Licenses 0",
      "HP StoreVirtual VSA Software running LeftHand OS \u003c=12.5",
      "HP HPE StoreVirtual 4000 Storage \u003c=12.5"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/95970",
  "serverity": "\u4e2d",
  "submitTime": "2017-02-10",
  "title": "\u591a\u6b3eHP\u4ea7\u54c1\u5b58\u5728\u672a\u660e\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CVE-2016-8529 (GCVE-0-2016-8529)

Vulnerability from cvelistv5 – Published: 2018-02-15 22:00 – Updated: 2024-09-17 04:13

Summary

A Remote Arbitrary Command Execution vulnerability in HPE StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS version v12.5 and earlier was found. The problem was resolved in LeftHand OS v12.6 or any subsequent version.

Severity

No CVSS data available.

CWE

Remote Arbitrary Command Execution

Assigner

hpe mitre root

References

3 references

URL	Tags
http://www.securitytracker.com/id/1037762	vdb-entryx_refsource_SECTRACK
https://support.hpe.com/hpsc/doc/public/display?d…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/95970	vdb-entryx_refsource_BID

Impacted products

1 product

Vendor	Product	Version
Hewlett Packard Enterprise	StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS	Affected: LeftHand OS v12.5 and earlier

Date Public

2017-01-31 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:40.678Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1037762",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037762"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c05382958"
          },
          {
            "name": "95970",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95970"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS",
          "vendor": "Hewlett Packard Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "LeftHand OS v12.5 and earlier"
            }
          ]
        }
      ],
      "datePublic": "2017-01-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Remote Arbitrary Command Execution vulnerability in HPE StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS version v12.5 and earlier was found. The problem was resolved in LeftHand OS v12.6 or any subsequent version."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Arbitrary Command Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-16T10:57:01.000Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "name": "1037762",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037762"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c05382958"
        },
        {
          "name": "95970",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95970"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-alert@hpe.com",
          "DATE_PUBLIC": "2017-01-31T00:00:00",
          "ID": "CVE-2016-8529",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "LeftHand OS v12.5 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Hewlett Packard Enterprise"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Remote Arbitrary Command Execution vulnerability in HPE StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS version v12.5 and earlier was found. The problem was resolved in LeftHand OS v12.6 or any subsequent version."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Arbitrary Command Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1037762",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037762"
            },
            {
              "name": "https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c05382958",
              "refsource": "CONFIRM",
              "url": "https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c05382958"
            },
            {
              "name": "95970",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95970"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2016-8529",
    "datePublished": "2018-02-15T22:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-09-17T04:13:55.467Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2017-01370

CVE-2016-8529 (GCVE-0-2016-8529)

Tags

Sightings

Nomenclature

Related by attack behaviour