Note: the current version of the following document is available here:https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05388115SUPPORT COMMUNICATION - SECURITY BULLETINDocument ID: c05388115Version: 1HPESBNS03702 rev.1 - HPE NonStop OSS Core Utilities with Bash Shell, LocalArbitrary Command Execution, Elevation of PrivilegeNOTICE: The information in this Security Bulletin should be acted upon assoon as possible.Release Date: 2017-02-09Last Updated: 2017-02-09Potential Security Impact: Local: Arbitrary Command Execution, Elevation ofPrivilegeSource: Hewlett Packard Enterprise, Product Security Response TeamVULNERABILITY SUMMARYSeveral potential security vulnerabilities have been discovered in the BashShell in NonStop OSS Core Utilities. The vulnerabilities allow local users toexecute arbitrary commands with root privileges.References: - CVE-2016-7543SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - NonStop Bash L series: T1202L01 - T1202L01^AAI; J and H series: T1202H01- - T1202H01^AAGBACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2016-7543 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here:https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499RESOLUTIONHPE has provided the following updates to resolve these vulnerabilities inthe Bash Shell in HPE NonStop OSS Core Utilities: * L Series: T1202L01^AAJ (OSS Core Utilities) * J Series: T1202H01^AAK (OSS Core Utilities) * H Series: T1202H01^AAK (OSS Core Utilities)Refer to NonStop Hotstuff HS03345 for additional details.HISTORYVersion:1 (rev.1) - 9 February 2017 Initial releaseThird Party Security Patches: Third party security patches that are to beinstalled on systems running Hewlett Packard Enterprise (HPE) softwareproducts should be applied in accordance with the customer's patch managementpolicy.Support: For issues about implementing the recommendations of this SecurityBulletin, contact normal HPE Services support channel. For other issues aboutthe content of this Security Bulletin, send e-mail to security-alert@hpe.com.Report: To report a potential security vulnerability for any HPE supportedproduct: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.comSubscribe: To initiate a subscription to receive future HPE Security Bulletinalerts via Email: http://www.hpe.com/support/Subscriber_ChoiceSecurity Bulletin Archive: A list of recently released Security Bulletins isavailable here: http://www.hpe.com/support/Security_Bulletin_ArchiveSoftware Product Category: The Software Product Category is represented inthe title by the two characters following HPSB.3C = 3COM3P = 3rd Party SoftwareGN = HPE General SoftwareHF = HPE Hardware and FirmwareMU = Multi-Platform SoftwareNS = NonStop ServersOV = OpenVMSPV = ProCurveST = Storage SoftwareUX = HP-UXCopyright 2016 Hewlett Packard EnterpriseHewlett Packard Enterprise shall not be liable for technical or editorialerrors or omissions contained herein. The information provided is provided"as is" without warranty of any kind. To the extent permitted by law, neitherHP or its affiliates, subcontractors or suppliers will be liable forincidental,special or consequential damages including downtime cost; lostprofits; damages relating to the procurement of substitute products orservices; or damages for loss of data, or software restoration. Theinformation in this document is subject to change without notice. HewlettPackard Enterprise and the names of Hewlett Packard Enterprise productsreferenced herein are trademarks of Hewlett Packard Enterprise in the UnitedStates and other countries. Other product and company names mentioned hereinmay be trademarks of their respective owners.
Note: the current version of the following document is available here:https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05388948SUPPORT COMMUNICATION - SECURITY BULLETINDocument ID: c05388948Version: 1HPESBHF03704 rev.1 - HPE OfficeConnect Network Switches, Local UnauthorizedData ModificationNOTICE: The information in this Security Bulletin should be acted upon assoon as possible.Release Date: 2017-02-10Last Updated: 2017-02-10Potential Security Impact: Local: Unauthorized Data ModificationSource: Hewlett Packard Enterprise, Product Security Response TeamVULNERABILITY SUMMARYA potential security vulnerability has been identified in HPE OfficeConnectNetwork Switches. The vulnerability could be exploited locally to allowunauthorized data modification.References: - CVE-2017-5786 - Local Unauthorized Data ModificationSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HPE OfficeConnect 1820 8G Switch J9979A - all software versions prior toPT.02.01 including: PT.01.03 through PT.02.01 - HPE OfficeConnect 1820 24G PoE+ (185W) Switch J9983A - all softwareversions prior to PT.02.01 including: PT.01.03 through PT.02.01 - HPE OfficeConnect 1820 24G Switch J9980A - all software versions prior toPT.02.01 including: PT.01.03 through PT.02.01 - HPE OfficeConnect 1820 48G PoE+ (370W) Switch J9984A - all softwareversions prior to PT.02.01 including: PT.01.03 through PT.02.01 - HPE OfficeConnect 1820 48G Switch J9981A - all software versions prior toPT.02.01 including: PT.01.03 through PT.02.01 - HPE OfficeConnect 1820 8G PoE+ (65W) Switch J9982A - all softwareversions prior to PT.02.01 including: PT.01.03 through PT.02.01BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2017-5786 4.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here:https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499The Hewlett-Packard Enterprise Company thanks Pekka Jrvinen (raspi) forreporting this vulnerability to security-alert@hpe.comRESOLUTIONHPE has made the following software update available to resolve thevulnerability in the impacted versions of HPE OfficeConnect Network Switch.Please install version PT.02.01 from the following location:<http://www.hpe.com/networking/support>HISTORYVersion:1 (rev.1) - 10 February 2017 Initial releaseThird Party Security Patches: Third party security patches that are to beinstalled on systems running Hewlett Packard Enterprise (HPE) softwareproducts should be applied in accordance with the customer's patch managementpolicy.Support: For issues about implementing the recommendations of this SecurityBulletin, contact normal HPE Services support channel. For other issues aboutthe content of this Security Bulletin, send e-mail to security-alert@hpe.com.Report: To report a potential security vulnerability for any HPE supportedproduct: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.comSubscribe: To initiate a subscription to receive future HPE Security Bulletinalerts via Email: http://www.hpe.com/support/Subscriber_ChoiceSecurity Bulletin Archive: A list of recently released Security Bulletins isavailable here: http://www.hpe.com/support/Security_Bulletin_ArchiveSoftware Product Category: The Software Product Category is represented inthe title by the two characters following HPSB.3C = 3COM3P = 3rd Party SoftwareGN = HPE General SoftwareHF = HPE Hardware and FirmwareMU = Multi-Platform SoftwareNS = NonStop ServersOV = OpenVMSPV = ProCurveST = Storage SoftwareUX = HP-UXCopyright 2016 Hewlett Packard EnterpriseHewlett Packard Enterprise shall not be liable for technical or editorialerrors or omissions contained herein. The information provided is provided"as is" without warranty of any kind. To the extent permitted by law, neitherHP or its affiliates, subcontractors or suppliers will be liable forincidental,special or consequential damages including downtime cost; lostprofits; damages relating to the procurement of substitute products orservices; or damages for loss of data, or software restoration. Theinformation in this document is subject to change without notice. HewlettPackard Enterprise and the names of Hewlett Packard Enterprise productsreferenced herein are trademarks of Hewlett Packard Enterprise in the UnitedStates and other countries. Other product and company names mentioned hereinmay be trademarks of their respective owners.
