ID

VAR-201002-0399

TITLE

Hitachi JP1/Cm2/Network Node Manager Insecure File Permissions Vulnerability

DESCRIPTION

Hitachi JP1/Cm2/Network Node Manager is prone to a security vulnerability because it sets insecure file permissions. An attacker can exploit this issue to obtain sensitive information or gain escalated privileges. ---------------------------------------------------------------------- Use WSUS to deploy 3rd party patches Public BETA http://secunia.com/vulnerability_scanning/corporate/wsus_3rd_third_party_patching/ ---------------------------------------------------------------------- TITLE: Hitachi JP1/Cm2/Network Node Manager Remote Console Insecure File Permissions SECUNIA ADVISORY ID: SA38740 VERIFY ADVISORY: http://secunia.com/advisories/38740/ DESCRIPTION: Hitachi has acknowledged a security issue in Hitachi JP1/Cm2/Network Node Manager, which can be exploited by malicious, local users to manipulate certain data and potentially gain escalated privileges. The security issue is reported in the following products and versions: * JP1/Cm2/Network Node Manager Enterprise version 06-51 to 06-71 * JP1/Cm2/Network Node Manager 250 version 06-51 to 06-71 * JP1/Cm2/Network Node Manager version 07-00 to 07-10 * JP1/Cm2/Network Node Manager Starter Edition Enterprise version 08-00 to 08-10 * JP1/Cm2/Network Node Manager Starter Edition 250 version 08-00 to 08-10 SOLUTION: Restrict access to trusted users only. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS10-002/index.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

THREAT TYPE

local

TYPE

Design Error

EXTERNAL IDS

REFERENCES

CREDITS

The vendor reported this issue.

SOURCES

LAST UPDATE DATE

2022-05-17T01:51:51.037000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE