Check Point Advisories

HP Power Manager formExportDataLogs Buffer Overflow (CVE-2009-3999)

Vulnerability
Protection

Check Point Reference:	CPAI-2010-111
Date Published:	22 Mar 2010
Severity:	Critical
Last Updated:	Monday 22 March, 2010
Source:
Industry Reference:	CVE-2009-3999
Protection Provided by:	Security Gateway R81, R80, R77, R75, R71, R70, R65
Who is Vulnerable?
Vulnerability Description	HP Power Manager is a web-based application for managing a HP Uninterruptible Power System (UPS) through a browser-based management console. It allows to monitor, manage, and control a single UPS locally and remotely. A buffer overflow vulnerability was reported in HP Power Manager. The vulnerability is due to lack of input validation of the variable on HTTP requests sent to formExportDataLogs. The vulnerable URI requires no authentication to process the malicious request. Successful exploitation could lead to execution of arbitrary code.

Protection Overview

This protection will detect and block HTTP requests to HP Power Manager forms whose fileName argument is larger than a certain threshold.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75 / R71 / R70 / R65

In the IPS tab, click Protections and find the HP Power Manager formExportDataLogs Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: HP Products Protection Violation.
Attack Information: HP Power Manager formExportDataLogs buffer overflow