HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote buffer overflow in dbman.exe opcode 10001 on Windows. This problem is resolved in IMC PLAT 7.3 (E0605P06) or subsequent versions.

The version of HPE Intelligent Management Center (iMC) PLAT installed on the remote host is prior to 7.3 E0605P06. It is, therefore, affected by multiple vulnerabilities :

  - A stack-based buffer overflow condition exists in the dbman     process due to improper validation of the length of user-supplied     data when decrypting a request message. An unauthenticated,     remote attacker can exploit this, via a specially crafted     request, to cause a denial of service condition or the execution     of arbitrary code. (CVE-2018-7114)

  - A stack-based buffer overflow condition exists in the dbman     process due to improper validation of the length of user-supplied     data when writing the data to a debug log. An unauthenticated,     remote attacker can exploit this, via a specially crafted     request, to cause a denial of service condition or the execution     of arbitrary code. (CVE-2018-7115)

  - A denial of service (DoS) vulnerability exists in the dbman     process due to improper validation of the length of user-supplied     data when processing an AsnPlatManualRestoreReqContent ASN.1     message. An unauthenticated, remote attacker can exploit this,     via a specially crafted request, to cause the process to     terminate and restart. (CVE-2018-7116)

Note that Intelligent Management Center (iMC) is an HPE product;
however, it is branded as H3C.

Detections

Analytics

CVE-2018-7115

medium

Tenable Plugins

critical