This script is Copyright (C) 2008-2014 Tenable Network Security, Inc.
The remote Windows host has an ActiveX control that allows reading and
writing of arbitrary files.
The remote host contains the HP Software Update software, installed by
default on many HP notebooks to support automatic software updates and
The version of this software on the remote host includes an ActiveX
control, 'HpeDiag', that reportedly contains multiple insecure
methods - 'ReadTextFile()' and 'WriteTextFile()' - that are marked as
'Safe for Scripting' and allow for reading and overwriting arbitrary
files on the affected system. If a remote attacker can trick a user
on the affected host into visiting a specially crafted web page, this
issue could be leveraged to effectively destroy arbitrary files on
the remote host, potentially even files that are vital for its
operation, or to read the contents of arbitrary files.
See also :
Either use HP Software Update itself to update the software or disable
use of this ActiveX control from within Internet Explorer by setting
its kill bit.
Risk factor :
High / CVSS Base Score : 9.3
CVSS Temporal Score : 6.9
Public Exploit Available : false