HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote denial of service via dbman Opcode 10003 'Filename'. This problem is resolved in IMC PLAT 7.3 (E0605P06) or subsequent versions.

The version of HPE Intelligent Management Center (iMC) PLAT installed on the remote host is prior to 7.3 E0605P06. It is, therefore, affected by multiple vulnerabilities :

  - A stack-based buffer overflow condition exists in the dbman     process due to improper validation of the length of user-supplied     data when decrypting a request message. An unauthenticated,     remote attacker can exploit this, via a specially crafted     request, to cause a denial of service condition or the execution     of arbitrary code. (CVE-2018-7114)

  - A stack-based buffer overflow condition exists in the dbman     process due to improper validation of the length of user-supplied     data when writing the data to a debug log. An unauthenticated,     remote attacker can exploit this, via a specially crafted     request, to cause a denial of service condition or the execution     of arbitrary code. (CVE-2018-7115)

  - A denial of service (DoS) vulnerability exists in the dbman     process due to improper validation of the length of user-supplied     data when processing an AsnPlatManualRestoreReqContent ASN.1     message. An unauthenticated, remote attacker can exploit this,     via a specially crafted request, to cause the process to     terminate and restart. (CVE-2018-7116)

Note that Intelligent Management Center (iMC) is an HPE product;
however, it is branded as H3C.

Detections

Analytics

CVE-2018-7116

high

Tenable Plugins

critical