NVD Vulnerability Detail

CVE-2016-2004

Summary	HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.
Publication Date	April 21, 2016, 8 p.m.
Registration Date	Jan. 26, 2021, 2:08 p.m.
Last Update	Nov. 21, 2024, 11:47 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/137199/HP-Data-Protector-A.09.00-Command-Execution.html	Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/137199/HP-Data-Protector-A.09.00-Command-Execution.html	Third Party Advisory VDB Entry
3	http://packetstormsecurity.com/files/137341/HP-Data-Protector-Encrypted-Communication-Remote-Command-Execution.html	Exploit Third Party Advisory VDB Entry
4	http://packetstormsecurity.com/files/137341/HP-Data-Protector-Encrypted-Communication-Remote-Command-Execution.html	Exploit Third Party Advisory VDB Entry
5	http://www.kb.cert.org/vuls/id/267328	Third Party Advisory US Government Resource
6	http://www.kb.cert.org/vuls/id/267328	Third Party Advisory US Government Resource
7	http://www.securitytracker.com/id/1035631	Third Party Advisory VDB Entry
8	http://www.securitytracker.com/id/1035631	Third Party Advisory VDB Entry
9	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988	Vendor Advisory
10	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988	Vendor Advisory
11	https://www.exploit-db.com/exploits/39858/	Exploit Third Party Advisory VDB Entry
12	https://www.exploit-db.com/exploits/39858/	Exploit Third Party Advisory VDB Entry
13	https://www.exploit-db.com/exploits/39874/	Exploit Third Party Advisory VDB Entry
14	https://www.exploit-db.com/exploits/39874/	Exploit Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-306	重要な機能に対する認証の欠如解説	https://cwe.mitre.org/data/definitions/306.html

JVN Vulnerability Information

HPE Data Protector における任意のコードを実行される脆弱性

Title	HPE Data Protector における任意のコードを実行される脆弱性
Summary	HPE Data Protector には、認証の欠如 (lack of authentication) に関する処理に不備があるため、任意のコードを実行される脆弱性が存在します。本脆弱性は、CVE-2014-2623 に対する修正が不十分だったことによる脆弱性です。補足情報 : CWE による脆弱性タイプは、CWE-306: Missing Authentication for Critical Function (重要な機能に対する認証の欠如) と識別されています。 http://cwe.mitre.org/data/definitions/306.html
Possible impacts	第三者により、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 18, 2016, midnight
Registration Date	April 28, 2016, 4:03 p.m.
Last Update	July 1, 2016, 4:54 p.m.

Affected System

ヒューレット・パッカード・エンタープライズ

HPE Data Protector 7.03_108 未満

HPE Data Protector 8.15 未満の 8.x

HPE Data Protector 9.06 未満の 9.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-2004	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2004
National Vulnerability Database (NVD)
2	CVE-2016-2004	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2004

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
HPE Security Bulletin
1	HPSBGN03580	http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05085988

その他

No	Name	URL
JVN
1	JVNVU#97620397	http://jvn.jp/vu/JVNVU97620397/index.html
US-CERT Vulnerability Note
2	VU#267328	http://www.kb.cert.org/vuls/id/267328

Change Log

No	Changed Details	Date of change
0	[2016年04月28日] 掲載 [2016年07月01日] 概要：内容を更新	Feb. 17, 2018, 10:37 a.m.