106211

1042182

https://support.hpe.com/hpsc/doc/public/display?docId=hpesbhf03906en_us

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03906en_us

The version of HPE Intelligent Management Center (iMC) PLAT installed on the remote host is prior to 7.3 E0605P06. It is, therefore, affected by multiple vulnerabilities :

  - A stack-based buffer overflow condition exists in the dbman     process due to improper validation of the length of user-supplied     data when decrypting a request message. An unauthenticated,     remote attacker can exploit this, via a specially crafted     request, to cause a denial of service condition or the execution     of arbitrary code. (CVE-2018-7114)

  - A stack-based buffer overflow condition exists in the dbman     process due to improper validation of the length of user-supplied     data when writing the data to a debug log. An unauthenticated,     remote attacker can exploit this, via a specially crafted     request, to cause a denial of service condition or the execution     of arbitrary code. (CVE-2018-7115)

  - A denial of service (DoS) vulnerability exists in the dbman     process due to improper validation of the length of user-supplied     data when processing an AsnPlatManualRestoreReqContent ASN.1     message. An unauthenticated, remote attacker can exploit this,     via a specially crafted request, to cause the process to     terminate and restart. (CVE-2018-7116)

Note that Intelligent Management Center (iMC) is an HPE product;
however, it is branded as H3C.

CVE-2018-7115

medium

Tenable Plugins

critical