Vulnerability-Lookup

CNVD-2021-29833

Vulnerability from cnvd - Published: 2021-04-21

Title

HPE Superdome Flex server拒绝服务漏洞

Description

HPE Superdome Flex Server是美国惠普企业公司（Hewlett Packard Enterprise，hpe）的一款模块化服务器产品。 HPE Superdome Flex server 3.30.142之前版本存在拒绝服务漏洞，攻击者可利用该漏洞使BMC web接口的连接挂起。

Severity

中

Patch Name

HPE Superdome Flex server拒绝服务漏洞的补丁

Patch Description

HPE Superdome Flex Server是美国惠普企业公司（Hewlett Packard Enterprise，hpe）的一款模块化服务器产品。 HPE Superdome Flex server 3.30.142之前版本存在拒绝服务漏洞，攻击者可利用该漏洞使BMC web接口的连接挂起。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04102en_us

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-26581

Impacted products

Name
HPE Superdome Flex Server <3.30.142

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-26581",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-26581"
    }
  },
  "description": "HPE Superdome Flex Server\u662f\u7f8e\u56fd\u60e0\u666e\u4f01\u4e1a\u516c\u53f8\uff08Hewlett Packard Enterprise\uff0chpe\uff09\u7684\u4e00\u6b3e\u6a21\u5757\u5316\u670d\u52a1\u5668\u4ea7\u54c1\u3002\n\nHPE Superdome Flex server 3.30.142\u4e4b\u524d\u7248\u672c\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f7fBMC web\u63a5\u53e3\u7684\u8fde\u63a5\u6302\u8d77\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1ahttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf04102en_us",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-29833",
  "openTime": "2021-04-21",
  "patchDescription": "HPE Superdome Flex Server\u662f\u7f8e\u56fd\u60e0\u666e\u4f01\u4e1a\u516c\u53f8\uff08Hewlett Packard Enterprise\uff0chpe\uff09\u7684\u4e00\u6b3e\u6a21\u5757\u5316\u670d\u52a1\u5668\u4ea7\u54c1\u3002\r\n\r\nHPE Superdome Flex server 3.30.142\u4e4b\u524d\u7248\u672c\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f7fBMC web\u63a5\u53e3\u7684\u8fde\u63a5\u6302\u8d77\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "HPE Superdome Flex server\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "HPE Superdome Flex Server \u003c3.30.142"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-26581",
  "serverity": "\u4e2d",
  "submitTime": "2021-04-16",
  "title": "HPE Superdome Flex server\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2021-26581 (GCVE-0-2021-26581)

Vulnerability from cvelistv5 – Published: 2021-04-01 18:42 – Updated: 2024-08-03 20:26

Summary

A potential security vulnerability has been identified in HPE Superdome Flex server. A denial of service attack can be remotely exploited leaving hung connections to the BMC web interface. The monarch BMC must be rebooted to recover from this situation. Other BMC management is not impacted. HPE has made the following software update to resolve the vulnerability in HPE Superdome Flex Server: Superdome Flex Server Firmware 3.30.142 or later.

Severity

No CVSS data available.

CWE

remote denial of service (dos)

Assigner

hpe

References

1 reference

URL	Tags
https://support.hpe.com/hpsc/doc/public/display?d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	HPE Superdome Flex Server	Affected: Prior to version 3.30.142

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:26:25.481Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf04102en_us"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "HPE Superdome Flex Server",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Prior to version 3.30.142"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A potential security vulnerability has been identified in HPE Superdome Flex server. A denial of service attack can be remotely exploited leaving hung connections to the BMC web interface. The monarch BMC must be rebooted to recover from this situation. Other BMC management is not impacted. HPE has made the following software update to resolve the vulnerability in HPE Superdome Flex Server: Superdome Flex Server Firmware 3.30.142 or later."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "remote denial of service (dos)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-01T18:42:53.000Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf04102en_us"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-alert@hpe.com",
          "ID": "CVE-2021-26581",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "HPE Superdome Flex Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Prior to version 3.30.142"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A potential security vulnerability has been identified in HPE Superdome Flex server. A denial of service attack can be remotely exploited leaving hung connections to the BMC web interface. The monarch BMC must be rebooted to recover from this situation. Other BMC management is not impacted. HPE has made the following software update to resolve the vulnerability in HPE Superdome Flex Server: Superdome Flex Server Firmware 3.30.142 or later."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "remote denial of service (dos)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf04102en_us",
              "refsource": "MISC",
              "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf04102en_us"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2021-26581",
    "datePublished": "2021-04-01T18:42:53.000Z",
    "dateReserved": "2021-02-02T00:00:00.000Z",
    "dateUpdated": "2024-08-03T20:26:25.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-29833

CVE-2021-26581 (GCVE-0-2021-26581)

Tags

Sightings

Nomenclature