HP Helion OpenStack glibc getaddrinfo RCE Vulnerability (CVE-2015-7547) Advisory

Key Information Summary Vulnerability Overview Document ID: HPSBGN03442 Rev.2 Vulnerability Title: HP Helion OpenStack using glibc Remote Denial of Service (DoS), Arbitrary Code Execution Potential Security Impact: Remote arbitrary code execution, Denial of Service (DoS) Source: HP Enterprise, HPE Product Security Response Team Vulnerability Summary Description: The implementation in glibc within HP Helion OpenStack has been fixed for stack-based buffer overflow vulnerabilities. These vulnerabilities could be exploited remotely, leading to Denial of Service (DoS) or allowing arbitrary code execution on the host (with privileges of the user running the glibc library). References: - CVE-2015-7547 - PSRT110041 Affected Software Versions Only affected versions listed: - HP Helion OpenStack 1.1.1, 2.0.0, 2.1.0 CVSS Score CVSS v2.0: - Base Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P) - Base Score: 6.8 Resolution Upgrade Path: - Helion OpenStack 1.1.1: - Customers should work with HP Helion Professional Services through existing support channels to assist with upgrading. - Helion OpenStack 2.0.x: - Recommended to upgrade to Helion OpenStack 2.1.2 or later: 1. Visit https://helion.hpwwportal.com/ 2. Follow the upgrade guide: http://docs.hpccloud.com/#helion/installation/upgrade20_to_212.html - Alternatively, upgrade to version 2.0.2: 1. Visit https://helion.hpwwportal.com/ 2. Follow the upgrade guide: http://docs.hpccloud.com/#helion/installation/upgrade20_to_202.html - Patch for 2.1.0: - Follow the same upgrade path as for 2.0.x. Additional Information History: - Version 1 (Rev.1) - Released on March 1, 2016 - Version 2 (Rev.2) - Released on June 6, 2016 Third-party Security Patches: Install relevant third-party security patches in accordance with customer patch management policies.

Goal Reached Thanks to every supporter — we hit 100%!

HP Helion OpenStack glibc getaddrinfo RCE Vulnerability (CVE-2015-7547) Advisory