Sign-up

ID

VAR-201609-0438


CVE

CVE-2016-4384


TITLE

HPE Performance Center and LoadRunner Service disruption in (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2016-004860

DESCRIPTION

HPE Performance Center before 12.50 and LoadRunner before 12.50 allow remote attackers to cause a denial of service via unspecified vectors. HP LoadRunner and Performance Center are prone to an unspecified denial-of-service vulnerability. A remote attacker can leverage this issue to cause denial-of-service condition. The following products are vulnerable: Versions prior to Performance Center 12.50 Versions prior to LoadRunner 12.50. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05278882 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05278882 Version: 1 HPSBGN03648 rev.1 - HPE LoadRunner and Performance Center, Remote Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2016-09-20 Last Updated: 2016-09-20 Potential Security Impact: Remote Denial of Service (DoS) Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Potential security vulnerability have been identified in HPE LoadRunner and Performance Center. This vulnerability could be exploited remotely to allow Denial of Service (DoS). References: CVE-2016-4384 PSRT110230 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HPE Performance Center - all versions prior to v12.50 HPE LoadRunner - all versions prior to v12.50 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2016-4384 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H 8.3 (AV:N/AC:M/Au:N/C:P/I:P/A:C) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 Hewlett Packard Enterprise thanks Tenable Network Security for reporting this issue to security-alert@hpe.com RESOLUTION HPE has released following updates to resolve the vulnerabilities in the impacted versions of LoadRunner and Performance Center: Performance Center v12.53 - https://softwaresupport.hp.com/group/softwaresupp ort/search-result/-/facetsearch/document/KM02354255 LoadRunner v12.53 - https://softwaresupport.hp.com/group/softwaresupport/sear ch-result/-/facetsearch/document/KM02320462 LoadRunner v12.50 patch 3 - https://softwaresupport.hp.com/group/softwaresupp ort/search-result/-/facetsearch/document/KM02040111 HISTORY Version:1 (rev.1) - 20 September 2016 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJX6VBSAAoJEGIGBBYqRO9/kV8IANtX4baDp0m/0Dnqfi0hlxga TQnS1TL9d38NDzvYLSzhbKIYLEoM4ymM/W376q+SD8bOjkiCZ7kmHAlZw/PHp0ny KewKknH/FPTjqoBCspHMxN8Cgos18/B4v8QPfnJE/xsFQcEmsPUnghB8ENR6m9ST rfPom6nDEg1zzMB5VdTuwQEx729/EQzSCEOm2yOLxMD9YPEhX/JMlf8UnQQW1skE MGr13WD89wBxM+tNMhQJDNLTMLd8lWfB9PTwxwOr4TE+mq+Pfiw1E9SvjUuZ/ikZ GBq4x7RHD3ZE37CR9aSxq55l1UwVaCMmBzyq8l20XjRvfQkyBggYYM3IV8ChmbM= =PGVh -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2016-4384 // JVNDB: JVNDB-2016-004860 // BID: 93069 // VULMON: CVE-2016-4384 // PACKETSTORM: 138846

AFFECTED PRODUCTS

vendor:hpmodel:performance centerscope:lteversion:12.20

Trust: 1.0

vendor:hpmodel:loadrunnerscope:lteversion:12.02

Trust: 1.0

vendor:hpmodel:performance centerscope:eqversion:12.20

Trust: 0.9

vendor:hpmodel:loadrunnerscope:eqversion:12.02

Trust: 0.9

vendor:hewlett packardmodel:hpe loadrunnerscope:ltversion:12.50

Trust: 0.8

vendor:hewlett packardmodel:hpe performance centerscope:ltversion:12.50

Trust: 0.8

vendor:hpmodel:performance center patchscope:eqversion:12.202

Trust: 0.3

vendor:hpmodel:performance center patchscope:eqversion:12.013

Trust: 0.3

vendor:hpmodel:performance centerscope:eqversion:12.01

Trust: 0.3

vendor:hpmodel:performance centerscope:eqversion:12.00

Trust: 0.3

vendor:hpmodel:performance center patchscope:eqversion:12.01

Trust: 0.3

vendor:hpmodel:performance centerscope:eqversion:12.0

Trust: 0.3

vendor:hpmodel:performance center patchscope:eqversion:11.523

Trust: 0.3

vendor:hpmodel:performance centerscope:eqversion:11.52

Trust: 0.3

vendor:hpmodel:loadrunnerscope:eqversion:11.52.1

Trust: 0.3

vendor:hpmodel:loadrunnerscope:eqversion:9.1

Trust: 0.3

vendor:hpmodel:loadrunnerscope:eqversion:9.0.0.0

Trust: 0.3

vendor:hpmodel:loadrunnerscope:eqversion:12.01

Trust: 0.3

vendor:hpmodel:loadrunnerscope:eqversion:12.0

Trust: 0.3

vendor:hpmodel:loadrunnerscope:eqversion:11.52

Trust: 0.3

vendor:hpmodel:loadrunnerscope:eqversion:11.0

Trust: 0.3

vendor:hpmodel:performance centerscope:neversion:12.53

Trust: 0.3

vendor:hpmodel:performance centerscope:neversion:12.50

Trust: 0.3

vendor:hpmodel:loadrunnerscope:neversion:12.53

Trust: 0.3

vendor:hpmodel:loadrunner patchscope:neversion:12.503

Trust: 0.3

vendor:hpmodel:loadrunnerscope:neversion:12.50

Trust: 0.3

sources: BID: 93069 // JVNDB: JVNDB-2016-004860 // CNNVD: CNNVD-201609-497 // NVD: CVE-2016-4384

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-4384
value: HIGH

Trust: 1.0

NVD: CVE-2016-4384
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201609-497
value: CRITICAL

Trust: 0.6

VULMON: CVE-2016-4384
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-4384
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 8.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2016-4384
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 4.7
version: 3.0

Trust: 1.8

sources: VULMON: CVE-2016-4384 // JVNDB: JVNDB-2016-004860 // CNNVD: CNNVD-201609-497 // NVD: CVE-2016-4384

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2016-4384

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201609-497

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201609-497

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-004860

PATCH
title:HPSBGN03648url:https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05278882
Trust: 0.8
title:HPE Performance Center  and LoadRunner Remediation measures for denial of service vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=64234
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-004860 // 
            
            
            
            CNNVD: CNNVD-201609-497

EXTERNAL IDS
db:NVDid:CVE-2016-4384
Trust: 2.9
db:BIDid:93069
Trust: 1.4
db:SECTRACKid:1036860
Trust: 1.1
db:SECTRACKid:1036859
Trust: 1.1
db:TENABLEid:TRA-2016-26
Trust: 1.1
db:JVNDBid:JVNDB-2016-004860
Trust: 0.8
db:CNNVDid:CNNVD-201609-497
Trust: 0.6
db:VULMONid:CVE-2016-4384
Trust: 0.1
db:PACKETSTORMid:138846
Trust: 0.1
sources:
            
            
            VULMON: CVE-2016-4384 // 
            
            
            
            BID: 93069 // 
            
            
            
            JVNDB: JVNDB-2016-004860 // 
            
            
            
            PACKETSTORM: 138846 // 
            
            
            
            CNNVD: CNNVD-201609-497 // 
            
            
            
            NVD: CVE-2016-4384

REFERENCES
url:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05278882
Trust: 1.7
url:http://www.securityfocus.com/bid/93069
Trust: 1.1
url:https://www.tenable.com/security/research/tra-2016-26
Trust: 1.1
url:http://www.securitytracker.com/id/1036860
Trust: 1.1
url:http://www.securitytracker.com/id/1036859
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-4384
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-4384
Trust: 0.8
url:http://www.hp.com
Trust: 0.3
url:https://h20566.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05278882
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=48977
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05278882
Trust: 0.1
url:http://www.hpe.com/support/security_bulletin_archive
Trust: 0.1
url:https://www.hpe.com/info/report-security-vulnerability
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4384
Trust: 0.1
url:http://www.hpe.com/support/subscriber_choice
Trust: 0.1
url:https://softwaresupport.hp.com/group/softwaresupport/sear
Trust: 0.1
url:https://softwaresupport.hp.com/group/softwaresupp
Trust: 0.1
url:https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c01345499
Trust: 0.1
sources:
            
            
            VULMON: CVE-2016-4384 // 
            
            
            
            BID: 93069 // 
            
            
            
            JVNDB: JVNDB-2016-004860 // 
            
            
            
            PACKETSTORM: 138846 // 
            
            
            
            CNNVD: CNNVD-201609-497 // 
            
            
            
            NVD: CVE-2016-4384

CREDITS
HP
Trust: 0.4
sources:
            
            
            BID: 93069 // 
            
            
            
            PACKETSTORM: 138846

SOURCES
db:VULMONid:CVE-2016-4384
db:BIDid:93069
db:JVNDBid:JVNDB-2016-004860
db:PACKETSTORMid:138846
db:CNNVDid:CNNVD-201609-497
db:NVDid:CVE-2016-4384

LAST UPDATE DATE
2025-04-13T23:31:26.188000+00:00

SOURCES UPDATE DATE
db:VULMONid:CVE-2016-4384date:2017-07-30T00:00:00
db:BIDid:93069date:2016-09-20T00:00:00
db:JVNDBid:JVNDB-2016-004860date:2016-09-27T00:00:00
db:CNNVDid:CNNVD-201609-497date:2016-09-21T00:00:00
db:NVDid:CVE-2016-4384date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULMONid:CVE-2016-4384date:2016-09-21T00:00:00
db:BIDid:93069date:2016-09-20T00:00:00
db:JVNDBid:JVNDB-2016-004860date:2016-09-27T00:00:00
db:PACKETSTORMid:138846date:2016-09-26T13:16:00
db:CNNVDid:CNNVD-201609-497date:2016-09-21T00:00:00
db:NVDid:CVE-2016-4384date:2016-09-21T02:59:11.210