HPE Asset Manager Arbitrary Code Execution Vulnerability (CVE-2016-2000)

HPE Asset Manager Arbitrary Code Execution Vulnerability (CVE-2016-2000)
HPE Asset Manager Arbitrary Code Execution Vulnerability (CVE-2016-2000)

Release date:
Updated on:

Affected Systems:

HP AssetManager 9.50
HP AssetManager 9.41
HP AssetManager 9.40
HP Asset Manager CloudSystem Chargeback 9.40

Description:

CVE (CAN) ID: CVE-2016-2000

HP AssetManager is a solution for managing the lifecycle of IT assets.

HPE Asset Manager 9.40, 9.41, 9.50, and Asset Manager CloudSystem Chargeback 9.40 have security vulnerabilities. Remote attackers can exploit this vulnerability to execute arbitrary commands by constructing serialized Java objects.

<* Source: HP

Link: https://h20564.www2.hpe.com/hpsc/doc/public/display? DocId = emr_na-c05064889
*>

Suggestion:

Vendor patch:

HP
--
HP has released a Security Bulletin (HPSBGN03567) for this purpose and the corresponding patch:
HPSBGN03567: HP Asset Manager using Java Deserialization, Remote Arbitrary Code Execution
Link: https://h20564.www2.hpe.com/hpsc/doc/public/display? DocId = emr_na-c05064889

This article permanently updates the link address: