HPE MOE 7.6 LR1 Multiple Remote Vulnerabilities Advisory (CVE-2017-8970/8971/8972/8973)

Key Information Summary Vulnerability Overview Vulnerability ID: HPESBMU03795 rev.1 Title: HPE Matrix Operating Environment, Multiple Remote Vulnerabilities Release Date: 2017-11-13 Last Updated: 2017-11-16 Potential Security Impact: Remote: Indirect Vulnerabilities, Unauthenticated Disclosure of Information Source: Hewlett Packard Enterprise, HPE Product Security Response Team Vulnerability Details Security vulnerabilities were identified in HPE Matrix Operating Environment (MOE) on Windows. These vulnerabilities can be exploited remotely, leading to unauthenticated information disclosure and indirect vulnerabilities. References PSRT110609 CVE-2017-8970 - Remote Unauthenticated Disclosure of Information (MSSW) CVE-2017-8971 - Clickjacking (VSE) CVE-2017-8972 - Clickjacking (MSSW) CVE-2017-8973 - Improper Input Validation (IO) Affected Software Versions Only affected version listed: HP Matrix Operating Environment Software 7.6 LR1 CVSS Scores CVE-2017-8970: V3 Base Score 4.3, V2 Base Score 5.0 CVE-2017-8971: V3 Base Score 2.6, V2 Base Score 3.5 CVE-2017-8972: V3 Base Score 2.6, V2 Base Score 3.5 CVE-2017-8973: V3 Base Score 2.6, V2 Base Score 3.5 Solution HPE has provided the following software update packages to address these vulnerabilities in HPE Matrix Operating Environment (MOE) 7.6 LR1. Obtain the HPE MOE 7.6 LR1 Update Kit from the HPE Support Center. Third-Party Security Patches Third-party security patches should be installed on systems running HPE software products in accordance with the customer’s patch management policy. Support For questions regarding implementation of the recommendations in this security bulletin, contact your regular HPE service support channel. For other questions related to the content of this security bulletin, email security-alert@hpe.com. Reporting Vulnerabilities Report potential security vulnerabilities in HPE support products via: - Web form: https://www.hpe.com/info/report-security-vulnerability - Email: security-alert@hpe.com

Goal Reached Thanks to every supporter — we hit 100%!

HPE MOE 7.6 LR1 Multiple Remote Vulnerabilities Advisory (CVE-2017-8970/8971/8972/8973)