Date: Thu,  8 Aug 2013 10:11:27 -0400 (EDT)
From: security-alert@...com
To: bugtraq@...urityfocus.com
Subject: [security bulletin] HPSBHF02912 rev.1 - HP Networking Products including H3C and 3COM Routers and Switches, OSPF Remote Information Disclosure and Denial of Service

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Note: the current version of the following document is available here:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c03880910

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c03880910
Version: 1

HPSBHF02912 rev.1 - HP Networking Products including H3C and 3COM Routers and
Switches, OSPF Remote Information Disclosure and Denial of Service

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date: 2013-08-08
Last Updated: 2013-08-08

Potential Security Impact: Remote information disclosure and denial of
service

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with HP Networking
Products including 3COM and H3C routers and switches. The vulnerabilities
could be remotely exploited resulting in disclosure of information and denial
of service.

References: CVE-2013-4806 (CERT VU#229804 SSRT101224)

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
Please refer to the RESOLUTION
 section below for a list of impacted products.

BACKGROUND

CVSS 2.0 Base Metrics
===========================================================
  Reference              Base Vector             Base Score
CVE-2013-4806    (AV:N/AC:M/Au:S/C:P/I:N/A:C)        7
===========================================================
             Information on CVSS is documented
            in HP Customer Notice: HPSN-2008-002

RESOLUTION
HP has made the following software updates available to resolve the
vulnerabilities in the following products:

Fixed Version
 HP Branded Products Impacted
 H3C Branded Products Impacted
 3Com Branded Products Impacted

R5000_3.14p14
 JD935A HP 5012 Router
JD943A HP 5232 Router
JD944A HP 5642 Router
JD945A HP Router 5642 TAA
JD946A HP 5682 Router
 N/A
 3Com Router 5642 TAA (3C13755TAA)
3Com Router 5012 (3C13701)
3Com Router 5232 (3C13751)
3Com Router 5642 (3C13755)
3Com Router 5682 (3C13759)

R301X_1.40.23
 JD916A HP 3012 Router
JD919A HP 3018 Router
 N/A
 3Com Router 3012 (3C13612)
3Com Router 3018 (3C13618)

S5600_3.10.R1702P39
 JD391A HP S5600-50C Ethernet Switch
JD392A HP S5600-50C-PWR Ethernet Switch
JD393A HP S5600-26C Ethernet Switch
JD394A HP S5600-26C-PWR Ethernet Switch
JD395A HP S5600-26F Ethernet Switch
 H3C S5600-26C Ethernet Switch (0235A11F)
H3C S5600-26C-PWR Ethernet Switch (0235A11G)
H3C S5600-26F Ethernet Switch (0235A11H)
H3C S5600-50C Ethernet Switch (0235A11D)
H3C S5600-50C-PWR Ethernet Switch (0235A11E)
 N/A

E5500G_03.03.02p19
 JE088A HP E5500-24G Switch
JE089A HP E5500-24G Switch (TAA)
JE090A HP E5500-48G Switch
JE091A HP E5500-48G Switch (TAA)
JE092A HP E5500-24G-PoE Switch
JE093A HP E5500-24G-PoE Switch (TAA)
JE094A HP E5500-48G-PoE Switch
JE095A HP E5500-48G-PoE Switch (TAA)
JE096A HP E5500-24G-SFP Switch
JE097A HP E5500-24G-SPF Switch (TAA)
JF551A HP SS4 SWITCH 5500G-EI 24PT (no psu)
JF552A HP SS4 SWITCH 5500G-EI 48PT(no psu)
JF553A HP SS4 5500G-EI 24 PORT
SFP (no psu)
 N/A
 3Com SS4 5500G-EI 24 Port SFP (NO PSU) (3CR17259-91)
3Com SS4 Switch 5500G-EI 24PT (NO PSU) (3CR17254-91)
3Com SS4 Switch 5500G-EI 48PT (NO PSU) (3CR17255-91)
3Com Switch 5500G-EI 24 Port (3CR17250-91)
3Com Switch 5500G-EI 48-Port (3CR17251-91)
3Com Switch 5500G-EI PWR 24-Port (3CR17252-91)
3Com Switch 5500G-EI PWR 48-Port (3CR17253-91)
3Com Switch 5500G-EI SFP 24-Port (3CR17258-91)
3Com TAA Compliant 5500G-EI 24-Port (3CR17250TAA-91)
3Com TAA Compliant 5500G-EI 48-Port (3CR17251TAA-91)
3Com TAA Compliant 5500G-EI PWR 24P (3CR17252TAA-91)
3Com TAA Compliant 5500G-EI PWR 48P (3CR17253TAA-91)
3Com TAA Compliant 5500G-EI SFP 24P (3CR17258TAA-91)

E5500_03.03.02p19
 JE099A HP E5500-24 SI Switch
JE100A HP E5500-48 SI Switch
JE101A HP E5500-24 Switch
JE102A HP E5500-24 Switch (TAA)
JE103A HP E5500-48 Switch
JE104A HP E5500-48 Switch (TAA)
JE105A HP E5500-24-PoE Switch
JE106A HP E5500-24-PoE Switch (TAA)
JE107A HP E5500-48-PoE Switch
JE108A HP E5500-48-PoE Switch (TAA)
JE109A HP E5500-24-SFP Switch,
JE110A HP E5500-24-SPF Switch (TAA)
 N/A
 3Com SS4 Switch 5500-SI 28 Port (3CR17151-91)
3Com SS4 Switch 5500-SI 52 Port (3CR17152-91)
3Com Switch 5500-EI 28-Port (3CR17161-91)
3Com Switch 5500-EI 28-Port FX (3CR17181-91) 3Com Switch 5500-EI 52-Port
(3CR17162-91)
3Com Switch 5500-EI PWR 28-Port (3CR17171-91) 3Com Switch 5500-EI PWR 52-Port
(3CR17172-91)
3Com TAA Switch 5500-EI 28-Port (3CR17161TAA-91)
3Com TAA Switch 5500-EI 28-Port FX (3CR17181TAA-91)
3Com TAA Switch 5500-EI 52-Port (3CR17162TAA-91)
3Com TAA Switch 5500-EI PWR 28-Port (3CR17171TAA-91)
3Com TAA Switch 5500-EI PWR 52-Port (3CR17172TAA-91)

S3600.EI_3.10.R1702P34
 JD326A HP 3600-24-PoE EI Switch
JD328A HP 3600-48-PoE EI Switch
JD331A HP 3600-24 EI Switch
JD333A HP 3600-48 EI Switch
JD334A HP 3600-24-SFP EI Switch
 H3C S3600-28F-EI - model LS-3600-28F-EI-OVS (0235A10L)
H3C S3600-28P-EI - model LS-3600-28P-EI-OVS (0235A10H)
H3C S3600-28P-PWR-EI - model LS-3600-28P-PWR-EI-OVS (0235A10C)
H3C S3600-52P-EI - model LS-3600-52P-EI-OVS (0235A10K)
H3C S3600-52P-PWR-EI - model LS-3600-52P-PWR-EI-OVS (0235A10E)
 N/A

E.11.38
 J4850A HP ProCurve Switch 5304xl
J8166A HP ProCurve Switch 5304xl-32G
J4819A HP ProCurve Switch 5308xl
J8167A HP ProCurve Switch 5308xl-48G
J4849A HP ProCurve Switch 5348xl
J4849B HP ProCurve Switch 5348xl
J4848A HP ProCurve Switch 5372xl
J4848B HP ProCurve Switch 5372xl

 N/A
 N/A

M.10.99
 J4906A HP E3400-48G cl Switch
J4905A HP ProCurve Switch 3400cl-24G
 N/A
 N/A

M.08.140
 J8433A HP 6400-6XG CL Switch J8474A HP 6410-6XG CL Switch
 N/A
 N/A

HISTORY
Version:1 (rev.1) - 8 August 2013 Initial Release

Third Party Security Patches: Third party security patches that are to be
installed on systems running HP software products should be applied in
accordance with the customer's patch management policy.

Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HP Services support channel.  For other issues about
the content of this Security Bulletin, send e-mail to security-alert@...com.

Report: To report a potential security vulnerability with any HP supported
product, send Email to: security-alert@...com

Subscribe: To initiate a subscription to receive future HP Security Bulletin
alerts via Email:
http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins

Security Bulletin Archive: A list of recently released Security Bulletins is
available here:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/

Software Product Category: The Software Product Category is represented in
the title by the two characters following HPSB.

3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX

Copyright 2013 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors
or omissions contained herein. The information provided is provided "as is"
without warranty of any kind. To the extent permitted by law, neither HP or
its affiliates, subcontractors or suppliers will be liable for
incidental,special or consequential damages including downtime cost; lost
profits;damages relating to the procurement of substitute products or
services; or damages for loss of data, or software restoration. The
information in this document is subject to change without notice.
Hewlett-Packard Company and the names of Hewlett-Packard products referenced
herein are trademarks of Hewlett-Packard Company in the United States and
other countries. Other product and company names mentioned herein may be
trademarks of their respective owners.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iEYEARECAAYFAlIDpdwACgkQ4B86/C0qfVldlwCcDDroDhqjX0UVp4i8jVvizBGx
XcQAnjFZJnhpwE7xpI1wxQZ1tdrFvaGL
=Q4Dh
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists