Sign-up

ID

VAR-201505-0145


CVE

CVE-2015-2122


TITLE

HP SDN VAN Controller Run on device REST Service disruption at the layer (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2015-002806

DESCRIPTION

The REST layer on HP SDN VAN Controller devices 2.5 and earlier allows remote attackers to cause a denial of service via network traffic to the REST port. HP SDN VAN Controller is prone to an unspecified denial-of-service vulnerability. A remote attacker can leverage this issue to cause denial-of-service condition. HP SDN VAN Controller 2.5 and prior are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04657823 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04657823 Version: 1 HPSBGN03329 rev.1 - HP SDN VAN Controller, Remote Denial of Service (DoS), Distributed Denial of Service (DDoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. References: CVE-2014-0050 Remote Denial of Service (DoS) CVE-2015-2122 Remote Distributed Denial of Service (DDoS) SSRT102049 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2014-0050 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2015-2122 (AV:N/AC:L/Au:N/C:N/I:N/A:C) 7.8 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP recommends either of the two following workarounds for the vulnerabilities in the HP SDN VAN Controller. For example: the Microsoft Lync Server for Optimizer. For more detailed information, please refer to the "Securing REST layer Access on HP VAN SDN Controllers" article at the following location: http://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=em r_na-c04676756 HISTORY Version:1 (rev.1) - 11 May 2015 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2015 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) iEYEARECAAYFAlVQ3n0ACgkQ4B86/C0qfVleJgCg+qPCFTzdKRL5cLe4eNH7Q82V w80AoOpSvjMM19ssS++abLKV1S+kypwk =Wtwj -----END PGP SIGNATURE-----

Trust: 2.52

sources: NVD: CVE-2015-2122 // JVNDB: JVNDB-2015-002806 // CNVD: CNVD-2015-03486 // BID: 74588 // PACKETSTORM: 131856

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2015-03486

AFFECTED PRODUCTS

vendor:hpmodel:sdn van controllerscope:lteversion:2.5

Trust: 1.0

vendor:hpmodel:sdn van controllerscope:eqversion:2.5

Trust: 0.9

vendor:hewlett packardmodel:hp virtual application network sdn controllerscope:lteversion:2.5

Trust: 0.8

vendor:hpmodel:sdn van controller devicesscope:lteversion:<=2.5

Trust: 0.6

sources: CNVD: CNVD-2015-03486 // BID: 74588 // JVNDB: JVNDB-2015-002806 // CNNVD: CNNVD-201505-522 // NVD: CVE-2015-2122

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-2122
value: HIGH

Trust: 1.0

NVD: CVE-2015-2122
value: HIGH

Trust: 0.8

CNVD: CNVD-2015-03486
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201505-522
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2015-2122
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2015-03486
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CNVD: CNVD-2015-03486 // JVNDB: JVNDB-2015-002806 // CNNVD: CNNVD-201505-522 // NVD: CVE-2015-2122

PROBLEMTYPE DATA

problemtype:CWE-399

Trust: 1.8

sources: JVNDB: JVNDB-2015-002806 // NVD: CVE-2015-2122

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201505-522

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201505-522

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-002806

PATCH
title:HPSBGN03329 SSRT102049url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04657823
Trust: 0.8
title:Patch for HP SDN VAN Controller devices Denial of Service Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/59109
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-03486 // 
            
            
            
            JVNDB: JVNDB-2015-002806

EXTERNAL IDS
db:NVDid:CVE-2015-2122
Trust: 3.4
db:BIDid:74588
Trust: 1.3
db:JVNDBid:JVNDB-2015-002806
Trust: 0.8
db:CNVDid:CNVD-2015-03486
Trust: 0.6
db:CNNVDid:CNNVD-201505-522
Trust: 0.6
db:PACKETSTORMid:131856
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-03486 // 
            
            
            
            BID: 74588 // 
            
            
            
            JVNDB: JVNDB-2015-002806 // 
            
            
            
            PACKETSTORM: 131856 // 
            
            
            
            CNNVD: CNNVD-201505-522 // 
            
            
            
            NVD: CVE-2015-2122

REFERENCES
url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04657823
Trust: 2.2
url:http://www.securityfocus.com/bid/74588
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2122
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2122
Trust: 0.8
url:http://www.hp.com
Trust: 0.3
url:https://h20564.www2.hp.com/hpsc/doc/public/display?docid=emr_na-c04657823
Trust: 0.3
url:http://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay/?docid=em
Trust: 0.1
url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/
Trust: 0.1
url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-2122
Trust: 0.1
url:http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-0050
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-03486 // 
            
            
            
            BID: 74588 // 
            
            
            
            JVNDB: JVNDB-2015-002806 // 
            
            
            
            PACKETSTORM: 131856 // 
            
            
            
            CNNVD: CNNVD-201505-522 // 
            
            
            
            NVD: CVE-2015-2122

CREDITS
HP
Trust: 0.4
sources:
            
            
            BID: 74588 // 
            
            
            
            PACKETSTORM: 131856

SOURCES
db:CNVDid:CNVD-2015-03486
db:BIDid:74588
db:JVNDBid:JVNDB-2015-002806
db:PACKETSTORMid:131856
db:CNNVDid:CNNVD-201505-522
db:NVDid:CVE-2015-2122

LAST UPDATE DATE
2025-04-12T22:03:19.878000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-03486date:2015-06-02T00:00:00
db:BIDid:74588date:2015-05-11T00:00:00
db:JVNDBid:JVNDB-2015-002806date:2015-05-28T00:00:00
db:CNNVDid:CNNVD-201505-522date:2015-05-26T00:00:00
db:NVDid:CVE-2015-2122date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CNVDid:CNVD-2015-03486date:2015-06-01T00:00:00
db:BIDid:74588date:2015-05-11T00:00:00
db:JVNDBid:JVNDB-2015-002806date:2015-05-28T00:00:00
db:PACKETSTORMid:131856date:2015-05-11T21:26:02
db:CNNVDid:CNNVD-201505-522date:2015-05-26T00:00:00
db:NVDid:CVE-2015-2122date:2015-05-25T14:59:18.153